title: What are the required permssions for Azure DevOps to execute Get-AzureADServicePrincipal cmdlet?
body: <p>I am deploying Azure Function based application using Azure DevOps pipeline, as part of deployment the required infrastructure is also provisioned (using ARM templates).  The Azure function needs to access Microsoft Graph &amp; SharePoint REST API's, to achieve this following steps are taken:</p>
  <ol>
  <li>Azure function is created with system assigned identity (MSI).</li>
  <li>The MSI (identity) is passed to below PowerShell script for enabling access to Graph &amp; SharePoint API.</li>
  </ol>
  <pre><code>$context = [Microsoft.Azure.Commands.Common.Authentication.Abstractions.AzureRmProfileProvider]::Instance.Profile.DefaultContext
  $context.Tenant.Id.ToString(), $null, [Microsoft.Azure.Commands.Common.Authentication.ShowDialog]::Never, $null, &quot;https://graph.microsoft.com&quot;).AccessToken
  $aadToken = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate($context.Account, $context.Environment, $context.Tenant.Id.ToString(), $null, [Microsoft.Azure.Commands.Common.Authentication.ShowDialog]::Never, $null, &quot;https://graph.windows.net&quot;).AccessToken
   
  Connect-AzureAD -AadAccessToken $aadToken -AccountId $context.Account.Id -TenantId $context.tenant.id
   
  $azureFunctionServicePrincipal = Get-AzureADServicePrincipal -Filter &quot;ObjectId eq '$PrincipalId'&quot;
  #Graph service principal
  $GraphServicePrincipal = Get-AzureADServicePrincipal -Filter &quot;appId eq '00000003-0000-0000-c000-000000000000'&quot;
  $GraphFilesReadWriteAllAppRole = $GraphServicePrincipal.AppRoles | Where-Object {$_.Value -in 'Files.ReadWrite.All' -and $_.AllowedMemberTypes -contains 'Application'}
  New-AzureAdServiceAppRoleAssignment -ObjectId $EcaseServicePrincipal.ObjectId -PrincipalId $EcaseServicePrincipal.ObjectId -ResourceId $GraphServicePrincipal.ObjectId -Id $GraphFilesReadWriteAllAppRole.Id
  
  $SharePointOnlineServicePrinciple = Get-AzureADServicePrincipal -SearchString “Office 365 SharePoint”
  $SharePointOnlineSitesReadWriteAllAppRole = $SharePointOnlineServicePrinciple.AppRoles | Where-Object {$_.Value -in 'Sites.ReadWrite.All' -and $_.AllowedMemberTypes -contains 'Application'}
  New-AzureAdServiceAppRoleAssignment -ObjectId $EcaseServicePrincipal.ObjectId -PrincipalId $EcaseServicePrincipal.ObjectId -ResourceId $SharePointOnlineServicePrinciple.ObjectId -Id $SharePointOnlineSitesReadWriteAllAppRole.Id
  </code></pre>
  <p>The PowerShell script while executing Get-AzureADServicePrincipal command fails due to insufficient privileges, this command is executing under the DevOps's ServiceConnection identity.  The ServiceConnection is assigned with following additional privileges,
  <a href="https://i.stack.imgur.com/Cp5Pa.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/Cp5Pa.png" alt="enter image description here" /></a></p>
  <p>I am unable to figure out what other privileges are required for GetServicePrincipal to succeed, and, also for execution of New-AzureAdServiceAppRoleAssignment cmdlet.</p>
  <p><strong>[Update 31st Aug, 2020]</strong>  Thanks to solution by AlleWu, the permission issue related GetServicePrincipal is resolved.  However, the permission issue for the execution of NewServicePrincipalAppRoleAssignment persists in spite of below permission, am i missing some step.  I have additionally made the ServiceConnection object as owner of the ResourceGroup, but this too failed.</p>
  <p><a href="https://i.stack.imgur.com/HCivy.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/HCivy.png" alt="Service Connection permissions" /></a></p>
  <p>NewServicePrincipalAppRoleAssignment execution error log:</p>
  <pre><code>2020-08-31T05:24:55.5613075Z ##[debug]+ New-AzureAdServiceAppRoleAssignment -ObjectId $EcaseServicePrincipal. ...
  2020-08-31T05:24:55.5639370Z ##[debug]+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  2020-08-31T05:24:55.5721318Z ##[debug]    + CategoryInfo          : NotSpecified: (:) [New-AzureADServiceAppRoleAssignment], ApiException
  2020-08-31T05:24:55.5744883Z ##[debug]    + FullyQualifiedErrorId : Microsoft.Open.AzureAD16.Client.ApiException,Microsoft.Open.AzureAD16.PowerShell.NewServ    icePrincipalAppRoleAssignment
  2020-08-31T05:24:55.5765560Z ##[debug] 
  2020-08-31T05:24:55.5834409Z ##[debug]Script stack trace:
  2020-08-31T05:24:55.5976760Z ##[debug]at &lt;ScriptBlock&gt;, D:\a\1\s\azure.pipelines\pwsh\provision_service_principle_for_sharepoint_graph.ps1: line 23
  2020-08-31T05:24:55.6006045Z ##[debug]at &lt;ScriptBlock&gt;, &lt;No file&gt;: line 1
  2020-08-31T05:24:55.6029248Z ##[debug]at &lt;ScriptBlock&gt;, D:\a\_tasks\AzurePowerShell_72a1931b-effb-4d2e-8fd8-f8472a07cb62\4.173.1\azurepowershell.ps1: line 229
  2020-08-31T05:24:55.6188575Z ##[debug]at &lt;ScriptBlock&gt;, D:\a\_tasks\AzurePowerShell_72a1931b-effb-4d2e-8fd8-f8472a07cb62\4.173.1\azurepowershell.ps1: line 225
  2020-08-31T05:24:55.6219503Z ##[debug]at &lt;ScriptBlock&gt;, &lt;No file&gt;: line 1
  2020-08-31T05:24:55.6243577Z ##[debug]at &lt;ScriptBlock&gt;, &lt;No file&gt;: line 22
  2020-08-31T05:24:55.6281986Z ##[debug]at &lt;ScriptBlock&gt;, &lt;No file&gt;: line 18
  2020-08-31T05:24:55.6331521Z ##[debug]at &lt;ScriptBlock&gt;, &lt;No file&gt;: line 1
  2020-08-31T05:24:55.6497107Z ##[debug]Exception:
  2020-08-31T05:24:55.6577566Z ##[debug]Microsoft.Open.AzureAD16.Client.ApiException: Error occurred while executing NewServicePrincipalAppRoleAssignment 
  2020-08-31T05:24:55.6607345Z ##[debug]Code: Authorization_RequestDenied
  2020-08-31T05:24:55.6683059Z ##[debug]Message: Insufficient privileges to complete the operation.
  2020-08-31T05:24:55.6712669Z ##[debug]RequestId: 14e5694e-bfde-404f-a441-4543871b1e56
  2020-08-31T05:24:55.6760142Z ##[debug]DateTimeStamp: Mon, 31 Aug 2020 05:24:53 GMT
  2020-08-31T05:24:55.6794376Z ##[debug]HttpStatusCode: Forbidden
  2020-08-31T05:24:55.6818439Z ##[debug]HttpStatusDescription: Forbidden
  2020-08-31T05:24:55.6842869Z ##[debug]HttpResponseStatus: Completed
  2020-08-31T05:24:55.6890342Z ##[debug]
  2020-08-31T05:24:55.6915727Z ##[debug]   at Microsoft.Open.AzureAD16.Client.Configuration.&lt;&gt;c.&lt;.cctor&gt;b__47_0(String methodName, IRestResponse response) in X:\bt\1137570\repo\src\dev\PowerShell.V2\AzureAD16.Client\Client\Configuration.cs:line 188
  2020-08-31T05:24:55.6947059Z ##[debug]   at Microsoft.Open.AzureAD16.Api.ServicePrincipalApi.NewServicePrincipalAppRoleAssignmentWithHttpInfo(String tenantId, String objectId, String authorization, String cmdletName, String clientRequestId, String apiVersion, AppRoleAssignment appRoleAssignment) in X:\bt\1137570\repo\src\dev\PowerShell.V2\AzureAD16.Client\Api\ServicePrincipalApi.cs:line 4006
  2020-08-31T05:24:55.6977721Z ##[debug]   at Microsoft.Open.AzureAD16.PowerShell.NewServicePrincipalAppRoleAssignment.ProcessRecord() in X:\bt\1137570\repo\src\dev\PowerShell.V2\AzureAD16.PowerShell\AzureAD16.PowerShell.AutoGen\API\ServicePrincipalApi.cs:line 2019
  2020-08-31T05:24:55.7008421Z ##[debug]   at System.Management.Automation.CommandProcessor.ProcessRecord()
  2020-08-31T05:24:55.7366976Z ##[error]Error occurred while executing NewServicePrincipalAppRoleAssignment 
  Code: Authorization_RequestDenied
  Message: Insufficient privileges to complete the operation.
  RequestId: 14e5694e-bfde-404f-a441-4543871b1e56
  DateTimeStamp: Mon, 31 Aug 2020 05:24:53 GMT
  HttpStatusCode: Forbidden
  HttpStatusDescription: Forbidden
  </code></pre>
  <p><strong>Update 1st Set, 2020:</strong> The alternate solution suggested above worked, below i have updated the script used to provision required permissions,</p>
  <pre><code>$context = [Microsoft.Azure.Commands.Common.Authentication.Abstractions.AzureRmProfileProvider]::Instance.Profile.DefaultContext
  $graphToken = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate($context.Account, $context.Environment, $context.Tenant.Id.ToString(), $null, [Microsoft.Azure.Commands.Common.Authentication.ShowDialog]::Never, $null, &quot;https://graph.microsoft.com&quot;).AccessToken
  $aadToken = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate($context.Account, $context.Environment, $context.Tenant.Id.ToString(), $null, [Microsoft.Azure.Commands.Common.Authentication.ShowDialog]::Never, $null, &quot;https://graph.windows.net&quot;).AccessToken
  
  Connect-AzureAD -AadAccessToken $aadToken -AccountId $context.Account.Id -TenantId $context.tenant.id
   
  $webAppServicePrincipal = Get-AzureADServicePrincipal -Filter &quot;ObjectId eq '$PrincipalId'&quot; #$PrincipalId is the ObjectId of the webApp instance
  $GraphServicePrincipal = Get-AzureADServicePrincipal -Filter &quot;appId eq '00000003-0000-0000-c000-000000000000'&quot;
  $GraphFilesReadWriteAllAppRole = $GraphServicePrincipal.AppRoles | Where-Object {$_.Value -in 'Files.ReadWrite.All' -and $_.AllowedMemberTypes -contains 'Application'}
  
  #It appears that the Azure DevOps's service connection need to have Global Administrator permissions to successfully execute the below statement; which is not recommended, hence, this is implemented calling Graph API 
  #New-AzureAdServiceAppRoleAssignment -ObjectId $EcaseServicePrincipal.ObjectId -PrincipalId $EcaseServicePrincipal.ObjectId -ResourceId $GraphServicePrincipal.ObjectId -Id $GraphFilesReadWriteAllAppRole.Id
  
  $resourceId = $GraphServicePrincipal.ObjectId
  $body = @{
    &quot;principalId&quot;= $webAppServicePrincipal.ObjectId
    &quot;resourceId&quot;= $resourceId
    &quot;appRoleId&quot;= $GraphFilesReadWriteAllAppRole.Id
  }
  
  $apiUrl = &quot;https://graph.microsoft.com/v1.0/servicePrincipals/$resourceId/appRoleAssignedTo&quot;
  Invoke-RestMethod -Uri $apiUrl -Headers @{Authorization = &quot;Bearer $($graphToken)&quot; }  -Method POST -Body $($body | convertto-json) -ContentType &quot;application/json&quot;
  </code></pre>