Unable to create App registration through MS graph when permissions granted through custom role

Question

Unable to create App registration through MS graph when permissions granted through custom role

Steiner, Stephan (sunrise-upc) 0

I have a custom role that has these permissions.

microsoft.directory/applications/createAsOwner
microsoft.directory/servicePrincipals/appRoleAssignedTo/read
microsoft.directory/servicePrincipals/appRoleAssignedTo/update
microsoft.directory/servicePrincipals/appRoleAssignments/read
microsoft.directory/servicePrincipals/createAsOwner

The role is assigned to a to my App Registration.

When I try to create a new app using the .NET SDK using this code

var app = await graph.Applications.PostAsync(
    new Application { DisplayName = displayName, SignInAudience = "AzureADMyOrg" });

I'm getting a

Authorization_RequestDenied - Insufficient privileges to complete the operation

error. When I assign the App Registration the Application.ReadWrite.OwnedBy MS graph permission, then it works.

Any idea what's going on here? I've used this same approach for other scenarios (creating / managing users and groups) where it works out just fine.

0 comments

1 answer

Your answer

Answer 1

The failure is caused by missing Microsoft Graph API permission, not just the custom Microsoft Entra role assignment.

Authorization_RequestDenied in Microsoft Graph typically requires both of these:

The appropriate Microsoft Entra RBAC role for the operation.
The necessary Microsoft Graph API permissions.

For app registration creation specifically:

microsoft.directory/applications/createAsOwner allows creating app registrations and adds the creator as the first owner.
That permission must be assigned at the directory scope. A create permission assigned at a resource scope does not grant the ability to create app registrations.
If the role is assigned only to the existing app registration, that is a resource-scope assignment, so it will not allow creating new app registrations.

That matches the behavior being seen:

Custom role assigned to the app registration resource: create call fails.
Adding Application.ReadWrite.OwnedBy Microsoft Graph permission: create call succeeds because the Graph API permission requirement is then satisfied for the call path being used.

What to change:

Verify the custom role assignment scope.
- For create permissions, assign the role at the directory scope (/), not on a specific app registration.
Keep the create permission needed for the intended behavior.
- microsoft.directory/applications/createAsOwner = creator becomes first owner and the object counts toward the creator’s 250-object quota.
- microsoft.directory/applications/create = creator is not added as first owner and the object does not count toward that 250-object quota.
- If both are assigned, microsoft.directory/applications/create takes precedence.
Ensure the calling app also has the required Microsoft Graph API permission for the SDK call.
- The Graph troubleshooting guidance states that Graph calls require both RBAC role and Graph API permission.

If the goal is for the service principal to create app registrations through Microsoft Graph, the supported setup is:

Create a custom role containing the app creation permission.
Assign that custom role to the service principal at directory scope.
Use the required Microsoft Graph API permission for the application.

References: