title: Assign Graph API App Permissions to Managed Identity in Azure DevOps Pipeline - Authorization_RequestDenied
body: <p>I have the the following cobbled together from various sources in my devops pipeline:</p>
  <pre><code>$MIName= &quot;my-identity-test-mi&quot;
  $RGName = &quot;my-identity-test-rg&quot;
  $Location = &quot;eastus&quot;
  $GraphAppId = &quot;00000003-0000-0000-c000-000000000000&quot;
  $PermissionName = &quot;Directory.Read.All&quot; 
  
  New-AzResourceGroup -Name $RGName -Location $Location -Force
  
  Install-Module -Name &quot;Az.ManagedServiceIdentity&quot; -Force
  
  New-AzUserAssignedIdentity -ResourceGroupName $RGName -Name $MIName
  
  Install-Module -Name &quot;AzureAD&quot; -Force
  
  $context = [Microsoft.Azure.Commands.Common.Authentication.Abstractions.AzureRmProfileProvider]::Instance.Profile.DefaultContext
  
  $graphToken = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate($context.Account, `
                          $context.Environment, $context.Tenant.Id.ToString(), $null, [Microsoft.Azure.Commands.Common.Authentication.ShowDialog]::Never, `
                          $null, &quot;https://graph.microsoft.com&quot;).AccessToken
  
  $aadToken = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate($context.Account, `
                      $context.Environment, $context.Tenant.Id.ToString(), $null, [Microsoft.Azure.Commands.Common.Authentication.ShowDialog]::Never, $null, `
                      &quot;https://graph.windows.net&quot;).AccessToken
  
  Write-Output &quot;ID $($context.Account.Id)&quot;
  
  Write-Output &quot;Account $($context.Account)&quot;
  
  Write-Output &quot;Type $($context.GetType())&quot;
  
  Connect-AzureAD -AadAccessToken $aadToken -AccountId $context.Account.Id -TenantId $context.tenant.id -MsAccessToken $graphToken
  
  $MSI = (Get-AzureADServicePrincipal -Filter &quot;displayName eq '$MIName'&quot;)
  
  $GraphServicePrincipal = Get-AzureADServicePrincipal -Filter &quot;appId eq '$GraphAppId'&quot;
  
  $AppRole = $GraphServicePrincipal.AppRoles | Where-Object {$_.Value -eq $PermissionName -and $_.AllowedMemberTypes -contains &quot;Application&quot;}
  
  New-AzureAdServiceAppRoleAssignment -ObjectId $MSI.ObjectId -PrincipalId $MSI.ObjectId -ResourceId $GraphServicePrincipal.ObjectId -Id $AppRole.Id
  </code></pre>
  <p>I have given the service principal that my pipeline runs as the following permissions:</p>
  <p><a href="https://i.stack.imgur.com/FOjrZ.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/FOjrZ.png" alt="enter image description here" /></a></p>
  <p>But when my pipeline runs I get:</p>
  <pre><code>Error occurred while executing NewServicePrincipalAppRoleAssignment 
  Code: Authorization_RequestDenied
  Message: Insufficient privileges to complete the operation.
  RequestId: d06466ff-a2b9-4b3f-a5d8-43aa5e6e107c
  DateTimeStamp: Sat, 17 Jul 2021 15:59:01 GMT
  HttpStatusCode: Forbidden
  HttpStatusDescription: Forbidden
  HttpResponseStatus: Completed
  PowerShell exited with code '1'.
  </code></pre>
  <p>This is not a case of run it twice and it works as seen that issue referenced so I'm guessing I've not quite got the permissions of my devops service principal correct but can't for the life of me work out what those permissions should be!</p>
  <p>Any advice appreciated</p>