{"id":6507,"date":"2022-07-01T13:51:52","date_gmt":"2022-07-01T12:51:52","guid":{"rendered":"https:\/\/rakhesh.com\/?p=6507"},"modified":"2022-07-01T13:52:31","modified_gmt":"2022-07-01T12:52:31","slug":"delegating-app-registration-admin-consent-permissions-in-azure-ad-an-example-for-sites-selected","status":"publish","type":"post","link":"https:\/\/rakhesh.com\/azure\/delegating-app-registration-admin-consent-permissions-in-azure-ad-an-example-for-sites-selected\/","title":{"rendered":"Delegating App Registration Admin Consent permissions in Azure AD (an example for Sites.Selected)"},"content":{"rendered":"<p>I had posted about this <a href=\"https:\/\/rakhesh.com\/azure\/delegating-app-registration-admin-consent-permissions-in-azure-ad\/\">previously<\/a>&#8230; today I wanted to send a bunch of cmdlets to my colleagues to allow admin consenting of the <code>Sites.Selected<\/code> (both Graph API and SharePoint API) permission to a custom role. Here&#8217;s the PowerShell code to do that, based on what I posted previously.<\/p>\n<pre class=\"lang:default decode:true \">Remove-Module AzureAD -ErrorAction SilentlyContinue\r\nImport-Module AzureADPreview\r\nConnect-AzureAD\r\n\r\n# Name of the policy\r\n$newPolicyId = \"mytenant-sharepoint-selected-permissions\"\r\n\r\n# Create the policy\r\nNew-AzureADMSPermissionGrantPolicy `\r\n    -Id $newPolicyId `\r\n    -DisplayName \"Selected SharePoint permissions\" `\r\n    -Description \"Allows Admin Consent to selected SharePoint\"\r\n\r\n# Get the Graph API SPN\r\n$graphSPN = Get-AzureADServicePrincipal -Filter \"DisplayName eq 'Microsoft Graph'\"\r\n\r\n# Get the Id of the Sites.Selected permission of the Graph SPN\r\n$permissionId = ($graphSPN | Select-Object -ExpandProperty AppRoles | Where-Object { $_.Value -eq \"Sites.Selected\" }).Id\r\n\r\n# Add this permission to the role\r\nNew-AzureADMSPermissionGrantConditionSet `\r\n    -PolicyId $newPolicyId `\r\n    -ConditionSetType \"includes\" `\r\n    -PermissionType \"application\" `\r\n    -ResourceApplication $graphSPN.AppId `\r\n\t-Permissions @($permissionId)\r\n\t\r\n# Repeat for SharePoint API\r\n$spoSPN = Get-AzureADServicePrincipal -Filter \"DisplayName eq 'Office 365 SharePoint Online'\"\r\n$permissionId = ($spoSPN | Select-Object -ExpandProperty AppRoles | Where-Object { $_.Value -eq \"Sites.Selected\" }).Id\r\nNew-AzureADMSPermissionGrantConditionSet `\r\n    -PolicyId $newPolicyId `\r\n    -ConditionSetType \"includes\" `\r\n    -PermissionType \"application\" `\r\n\t-ResourceApplication $spoSPN.AppId `\r\n\t-Permissions @($permissionId)\r\n\r\n# Create the custom role\r\n$displayName = \"Application administrator (SharePoint)\"\r\n$description = \"Can manage more aspects of application registrations.\"\r\n$templateId = (New-Guid).Guid\r\n \r\n# Set of permissions to grant\r\n$allowedResourceAction =\r\n@(\r\n    \"microsoft.directory\/applications\/create\",\r\n    \"microsoft.directory\/servicePrincipals\/allProperties\/read\",\r\n    \"microsoft.directory\/servicePrincipals\/create\",\r\n    \"microsoft.directory\/servicePrincipals\/managePermissionGrantsForSelf.$newPolicyId\",\r\n    \"microsoft.directory\/servicePrincipals\/managePermissionGrantsForAll.$newPolicyId\"\r\n)\r\n$rolePermissions = @{'allowedResourceActions'= $allowedResourceAction}\r\n\r\n# Create the custom role\r\n$customAdmin = New-AzureADMSRoleDefinition -RolePermissions $rolePermissions -DisplayName $displayName -Description $description -TemplateId $templateId -IsEnabled $true<\/pre>\n<p>Since the previous post I&#8217;ve fumbled my way to being more knowledgeable about Azure AD so there&#8217;s some minor differences in the code to what I posted then. Less hard-coding of ids etc. That post still has all the background info on what I am doing above so be sure to read that if the above makes no sense.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I had posted about this previously&#8230; today I wanted to send a bunch of cmdlets to my colleagues to allow admin consenting of the Sites.Selected (both Graph API and SharePoint API) permission to a custom role. Here&#8217;s the PowerShell code to do that, based on what I posted previously. Remove-Module AzureAD -ErrorAction SilentlyContinue Import-Module AzureADPreview &hellip; <a href=\"https:\/\/rakhesh.com\/azure\/delegating-app-registration-admin-consent-permissions-in-azure-ad-an-example-for-sites-selected\/\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">Delegating App Registration Admin Consent permissions in Azure AD (an example for Sites.Selected)<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[887],"tags":[1031,1024],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/6507"}],"collection":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/comments?post=6507"}],"version-history":[{"count":0,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/6507\/revisions"}],"wp:attachment":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/media?parent=6507"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/categories?post=6507"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/tags?post=6507"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}