title: How do I set a SharePoint-hosted app's permissions via PowerShell?
body: <p>I'm deploying apps using <code>Import-SPAppPackage</code> and <code>Install-SPApp</code>. I'd like to be able to use <code>Set-AppPrincipalPermission</code> to set permissions but I can't get it working.</p>
  
  <p>I'm uploading a SharePoint-hosted app to SharePoint using the PowerShell cmdlets <code>Import-SPAppPackage</code> and <code>Install-SPApp</code>. This is working fine for SharePoint-hosted apps that do not require additional permissions.</p>
  
  <p>However, one app needs read access to the site, so this is declared in the manifest. And it works fine when run through Visual Studio - on first launch, it correctly asks to trust the app for read access to the site.</p>
  
  <p>When I add this app via PowerShell, it has no opportunity to ask. The install continues without problems, but then the app doesn't work. (It fails with a permissions problem, which is absolutely the correct behavour since the permissions haven't yet been granted.)</p>
  
  <p>I can fix the permissions by going to the Site Contents, clicking on the '...' for the problem app, choosing 'Permissions' and then clicking the link that says 'If there's something wrong with the app's permissions, click here to trust it again'.</p>
  
  <p>But I really want to just be able to do the whole deployment via PowerShell.</p>
  
  <p>The <code>Set-AppPrincipalPermission</code> cmdlet should allow me to set the permissions, but I can't get it to work. Specifically, I can't get a handle on the app principal that was automatically created when the app was deployed, so I can't pass this app principal to <code>Set-AppPrincipalPermission</code>.</p>
  
  <p>The app principal has a name of the form 'i:0i.t|ms.sp.int|@' and it is listed on /_layouts/15/appprincipals.aspx. When I use <code>Get-SPAppPrincipal</code> with it, all I get is:</p>
  
  <pre><code>Get-SPAppPrincipal : The app principal could not be found.
  </code></pre>
  
  <p>I haven't seen any examples of using <code>Get-SPAppPrincipal</code> for any SharePoint-hosted apps - they all seem to be for provider-hosted apps. They also all seem to just use an app principal ID built from the client ID and the realm ID, but my SharePoint-hosted app doesn't have a client ID.</p>
  
  <p>Is it possible to get the app principal of a SharePoint-hosted app and use it to set the permissions via PowerShell? Am I doing something wrong, or is there another approach?</p>