title: Grant access to AAD Graph API's for a Managed Identity
body: <p>I'm following the following article on accessing the AAD Graph API using a managed identity - <a href="https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-azure-ad-graph" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-azure-ad-graph</a></p>
  
  <p>With my global admin account I am executing something along the lines of the following in powershell:</p>
  
  <pre><code>$AppRole = $WindowsAADServicePrincipal.AppRoles | Where-Object {$_.Value -eq "Application.ReadWrite.All" -and $_.AllowedMemberTypes
  -contains "Application"}
  New-AzureAdServiceAppRoleAssignment -ObjectId $identity.PrincipalId -PrincipalId $identity.PrincipalId  -ResourceId
  $WindowsAADServicePrincipal.ObjectId -Id $AppRole.Id
  </code></pre>
  
  <p>The command reports the following Insufficient privileges exception - but the role seems to be still assigned to the service principal!!??</p>
  
  <blockquote>
    <p>New-AzureAdServiceAppRoleAssignment : Error occurred while executing
    NewServicePrincipalAppRoleAssignment  Code:
    Authorization_RequestDenied Message: Insufficient privileges to
    complete the operation. RequestId: XXX DateTimeStamp: Mon, 17 Jun 2019
    15:16:53 GMT HttpStatusCode: Forbidden HttpStatusDescription:
    Forbidden HttpResponseStatus: Completed At line:5 char:5
    +     New-AzureAdServiceAppRoleAssignment -ObjectId $identity.Principal ...
    +     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        + CategoryInfo          : NotSpecified: (:) [New-AzureADServiceAppRoleAssignment], ApiException
        + FullyQualifiedErrorId : Microsoft.Open.AzureAD16.Client.ApiException,Microsoft.Open.AzureAD16.PowerShell.NewServicePrincipalAppRoleAssignment</p>
  </blockquote>
  
  <p>My question is Why? If I look at an http trace of the requests made by this command to the aad graph api I dont see much of interest.</p>
  
  <p>If I execute the request manually to assign a role using the managed identity above to which I assigned the required permissions. I get a similar exception but no role is assigned, whats odd is that I have tried assigning a number of permissions to the identity executing this request - up to even Global Admin on the tenant but I still see this error.... </p>
  
  <pre><code>$created_permissions = Invoke-RestMethod -Method post -Uri "https://graph.windows.net/tenantname.onmicrosoft.com/servicePrincipals/$($created_principal.objectid)/appRoleAssignments?api-version=1.6" -Body ($permission  | ConvertTo-Json -Depth 99 -Compress) -ContentType "application/json" -Headers @{ "Authorization" ="Bearer $access_token" }
  </code></pre>
  
  <p>I would like to avoid giving the identity Global Admin or similar role and would prefer if could give a granular permission i.e. Application.ReadWrite.OwnedBy</p>