A cloud-based identity and access management service for securing user authentication and resource access
Hello Kevin Low,
Note: To assign Default Access (that is no app role) as app role, you need to pass app role ID as ([Guid]::Empty)
$EnterpriseAppObjectId = "ID"
Connect-MgGraph -Identity -nowelcome
$sp = Get-MgServicePrincipal -ServicePrincipalId $EnterpriseAppObjectId -ErrorAction Stop
Write-Output "Enterprise App Found: $($sp.DisplayName)"
# Get existing group assignments
$existingAssigned = Get-MgServicePrincipalAppRoleAssignedTo `
-ServicePrincipalId $EnterpriseAppObjectId -All
$existingPrincipalIds = $existingAssigned.PrincipalId
# Get groups
$groups = Get-MgGroup -Filter "startsWith(displayName,'ruk')" -All
foreach ($group in $groups) {
if ($existingPrincipalIds -contains $group.Id) {
Write-Output "Skipping existing group: $($group.DisplayName)"
continue
}
try {
New-MgServicePrincipalAppRoleAssignment `
-ServicePrincipalId $EnterpriseAppObjectId `
-PrincipalId $group.Id `
-ResourceId $EnterpriseAppObjectId `
-AppRoleId ([Guid]::Empty)
Write-Output "Assigned: $($group.DisplayName)"
}
catch {
Write-Output "Failed: $($group.DisplayName) - $_"
}
}
By passing AppRoleId as ([Guid]::Empty), the group will be assigned with no app role that is as default access successfully:
If the resolution was helpful, kindly take a moment to click on
and click on Yes for was this answer helpful. And, if you have any further query do let us know.