Unable to add Azure Active Directory Graph permissions to an application in Azure Portal

[jiasli]

In Azure Portal -> Azure Active Directory, users cannot add Azure Active Directory Graph permissions to a newly created application. The option is greyed out with a notification that you should use the new Microsoft Graph instead:

This means that for newly created Service Principals, users are currently unable to use az ad commands in automation workflows.

Originally posted by Renske Wierda (@renskewierda) in #12946 (comment)

[jiasli]

Explanation

Following the announcement of Azure Active Directory Graph retirement, users cannot add permissions of Azure Active Directory Graph to Azure Active Directory applications via Azure Portal. This feature retirement was announced on Twitter.

This affects the usage of Azure CLI (#12946 (comment)) and Azure PowerShell (Azure/azure-powershell#16009), as Azure CLI az ad commands and Azure PowerShell's AzAD cmdlets are still using Azure Active Directory Graph.

Workaround

For now, you may use az ad app permission add to add Azure Active Directory Graph permissions.

[Optional] After the permission is added to an application, if needed, you may grant admin consent using either

• Azure Portal's Grant admin consent for [TenantName] button
• Azure CLI commands: az ad app permission grant not working or usable as expected #12137 (comment)

Additional information

Alternatively, to add Azure Active Directory Graph permissions with PowerShell cmdlets, please see Azure/azure-powershell#16067.

[justinmchase]

I don't want to add the old permissions, what I want is to create a new application through the new graph API, will az ad app create ... use the new API and operate off of the new permissions?

[jiasli]

will az ad app create ... use the new API and operate off of the new permissions?

Absolutely. Tracked by #12946.

[jiasli]

I have provided a full script in #20792 (comment) to demonstrate how to grant AD Graph permissions to a service principal with Azure CLI.