> For the complete documentation index, see [llms.txt](https://docs.smsagent.blog/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.smsagent.blog/microsoft-endpoint-manager-reporting/intune-assignments-report/grant-api-permissions.md).

# Grant API permissions

## Managed identity

We need to grant API permissions to the service principal object in Azure. For a managed identity, this should be done with PowerShell at the time of writing.

Run the following PowerShell code to grant the required API permissions if they are not present already. You need the **Microsoft Graph PowerShell SDK** installed and the **Global administrator** or **Application administrator** role.

Set the following variables in the script:

* **TenantID**. This is the tenant ID for your tenant.
* **EnterpriseAppName**. This is the display name of your Azure automation account and its service principal.

{% hint style="info" %}
Note these are **application** permissions not **delegated** permissions
{% endhint %}

```powershell
# Tenant Id
$TenantId = "<MyTenantId>"
# List of permission names
$RolesToAssign = @(
    "DeviceManagementApps.Read.All"
    "DeviceManagementConfiguration.Read.All"
    "DeviceManagementServiceConfig.Read.All"
    "CloudPC.Read.All"
    "DeviceManagementRBAC.Read.All"
    "GroupMember.Read.All"
    "DeviceManagementScripts.Read.All"
)
#  DisplayName of the Enterprise App you are assigning permissions to
$EnterpriseAppName = "<MyAppName>"
# Connect to Graph
Import-Module Microsoft.Graph.Applications
Connect-Graph -TenantId $TenantId -NoWelcome
# Get the service principals
$GraphApp = Get-MgServicePrincipal -Filter "AppId eq '00000003-0000-0000-c000-000000000000'" # Microsoft Graph
$EnterpriseApp = Get-MgServicePrincipal -Filter "DisplayName eq '$EnterpriseAppName'"
# Assign the roles
foreach ($Role in $RolesToAssign) {
    $Role = $GraphApp.AppRoles | Where-Object { $_.Value -eq $Role }
    $params = @{
        principalId = $EnterpriseApp.Id
        resourceId = $GraphApp.Id
        appRoleId = $Role.Id
    }
    New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $EnterpriseApp.Id -BodyParameter $params
}
```

Once granted, you will find these permissions listed against the **Enterprise application** for your managed identity in the **Permissions** blade, for example:

<figure><img src="/files/kx0CF7L0jSRdcryFMGtA" alt=""><figcaption></figcaption></figure>