# Grant API permissions

## Managed identity

We need to grant API permissions to the service principal object in Azure. For a managed identity, this should be done with PowerShell at the time of writing.

Run the following PowerShell code to grant the required API permissions if they are not present already. You need the **Microsoft Graph PowerShell SDK** installed and the **Global administrator** or **Application administrator** role.

Set the following variables in the script:

* **TenantID**. This is the tenant ID for your tenant.
* **EnterpriseAppName**. This is the display name of your Azure automation account and its service principal.

{% hint style="info" %}
Note these are **application** permissions not **delegated** permissions
{% endhint %}

```powershell
# Tenant Id
$TenantId = "<MyTenantId>"
# List of permission names
$RolesToAssign = @(
    "DeviceManagementApps.Read.All"
    "DeviceManagementConfiguration.Read.All"
    "DeviceManagementServiceConfig.Read.All"
    "CloudPC.Read.All"
    "DeviceManagementRBAC.Read.All"
    "GroupMember.Read.All"
    "DeviceManagementScripts.Read.All"
)
#  DisplayName of the Enterprise App you are assigning permissions to
$EnterpriseAppName = "<MyAppName>"
# Connect to Graph
Import-Module Microsoft.Graph.Applications
Connect-Graph -TenantId $TenantId -NoWelcome
# Get the service principals
$GraphApp = Get-MgServicePrincipal -Filter "AppId eq '00000003-0000-0000-c000-000000000000'" # Microsoft Graph
$EnterpriseApp = Get-MgServicePrincipal -Filter "DisplayName eq '$EnterpriseAppName'"
# Assign the roles
foreach ($Role in $RolesToAssign) {
    $Role = $GraphApp.AppRoles | Where-Object { $_.Value -eq $Role }
    $params = @{
        principalId = $EnterpriseApp.Id
        resourceId = $GraphApp.Id
        appRoleId = $Role.Id
    }
    New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $EnterpriseApp.Id -BodyParameter $params
}
```

Once granted, you will find these permissions listed against the **Enterprise application** for your managed identity in the **Permissions** blade, for example:

<figure><img src="/files/kx0CF7L0jSRdcryFMGtA" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.smsagent.blog/microsoft-endpoint-manager-reporting/intune-assignments-report/grant-api-permissions.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.