How to remove API permissions from App Registration using Microsoft graph ?

[sritapa]

az feedback auto-generates most of the information requested below, as of CLI version 2.0.62

az ad app permission delete --id <> --api <>

Azure Ad Graph API is no longer supported ,need the Microsoft graph API equivalent of the command to delete API permissions from App registrations

Run this on Azure powershell az ad app permission delete --id <> --api <>

The requested API permission should had been deleted

Azure powershell , owner of the application

Looking for Azure CLI commands in Microsoft Graph API to delete API permissions from App registration.

Documentation missing this scenario/unclear - https://docs.microsoft.com/en-us/cli/azure/microsoft-graph-migration

Current error -

This command or command group has been migrated to Microsoft Graph API. Please carefully review all breaking changes introduced during this migration: https://docs.microsoft.com/cli/azure/microsoft-graph-migration
The size of the object has exceeded its limit. Please reduce the number of values and retry your request.

[yonzhan]

@jiasli for awareness

[jiasli]

Regarding error:

The size of the object has exceeded its limit. Please reduce the number of values and retry your request.

Your problem is that the requiredResourceAccess property references permissions from more than 10 "remote" APIs (i.e. API registered in tenants different from the tenant where this app is registered). This limitation is documented here: https://docs.microsoft.com/en-us/azure/active-directory/develop/supported-accounts-validation (which is linked to from https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/directory-service-limits-restrictions).

no more than 10 APIs from other tenants

Microsoft Graph team has opened a bug to improve the error message: https://identitydivision.visualstudio.com/Engineering/_workitems/edit/1924704

Solution

You may update requiredResourceAccess with following methods:

• Update permissions in Azure Portal -> Azure Active Directory -> App registrations > select your app -> API permissions
• Use az ad app update --required-resource-accesses
• Use az rest with Update application API to change requiredResourceAccess? Examples can be found at Microsoft Graph API Support #12946.