CODEWITHSUNDEEP
azure-active-directorymicrosoft-graph-api
Simon
Simon

Reputation: 1693

Using Microsoft Graph API to find all Applications with Admin Consent Granted

As per the title I can't find anywhere that explicitly gives me the information and my best guess was to use

https://graph.microsoft.com/v1.0/applications

and look at the requiredResourceAccess but that doesn't appear to provide the information about actual consent.

Is the mere presence of entries in here proof that admin consent was required, I'm going to guess at no as I added permissions to an app and even before granting consent the entries appeared in requiredResourceAccess and the entries didn't change when I granted consent.

Upvotes: 1

Views: 1922

Answers (1)

Philippe Signoret
Philippe Signoret

Reputation: 14326

When consent is granted for an application, three things may happen:

  1. A service principal (servicePrincipal) representing the identity of the client application (the one being given access) is created, if it didn't already exist.
  2. For every API to which the client application is granted delegated permissions, a delegated permission grant (oauth2PermissionGrant) is created.
  3. For every app-only permission client application is granted, a app role assignment* (appRoleAssignment) is created.

(Depending on which permission the app requires, #2 or #3 might be unnecessary.)

So, "what applications have been granted admin consent?" can be equated to "what service principals exist which have been granted tenant-wide delegated permissions, or app-only permissions?"

  1. To list all service principals in the tenant: 
    GET https://graph.microsoft.com/v1.0/servicePrincipals
  2. To get all tenant-wide delegated permissions granted to a given service principal: 
    GET https://graph.microsoft.com/v1.0/oauth2PermissionGrants
       ?$filter=clientId eq {id} and consentType eq 'AllPrincipals'
  3. To get all app roles (app-only permissions) granted to a service principal: 
    GET https://graph.microsoft.com/v1.0/servicePrincipals/{id}/appRoleAssignments

To map the granted app role IDs or delegated permission scope values to the display names and descriptions, you can look up the granted app roles to the appRoles and oauth2PermissionScopes collections on the resource service principal (i.e. the service principal representing the API).

This can all be done with Azure AD PowerShell and wrapped into a function to dump out delegated and app-only permission grants. Here is an example: Get-AzureADPSPermissions.ps1

Upvotes: 3

Related Questions