title: Cannot set "preAuthorizedApplications" object in new App registrations module through Azure Powershell
body: <p><strong>Short Scenrario</strong>: A muti tenant front end javascript (React.JS) Web Application calls a multi tenant ASP.NET Core 2.2 WebAPI from the browser.</p>
  
  <p><em>Authentication:</em></p>
  
  <ol>
  <li><p>ADAL.js in the front end app takes care of getting a token from either AzureAD1 or AzureAD2 or AzureAD3... when the User signs-in (based on the User's original Azure Active Directory). </p></li>
  <li><p>The User gives consent to the front end Web App (<em>scope: Sign in and read user profile</em>) which is delegated to the WebAPI too. (<em>meaning the user does not need to consent to the WebAPI as well</em>)</p></li>
  <li><p>The front end Web App calls the WebAPI with the bearer token to get the resources.</p></li>
  </ol>
  
  <p><strong>Problem: I must automate the deployment of a new environment. And set the manifest file accordingly (It's a SaaS solution)</strong></p>
  
  <ol>
  <li>In the manifest file I need to expose the WebAPI for the client application (<a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-configure-app-expose-web-apis#expose-a-new-scope-through-the-ui" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-configure-app-expose-web-apis#expose-a-new-scope-through-the-ui</a>)</li>
  <li>Setting "knownClientApplications" is not enough (<em>due to previously described delegation</em>)</li>
  <li>The new v2 endpoint (<a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-overview" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-overview</a>) has a new App Registration feature. The old one is called "Legacy" now and will be deprecated starting May 2019.</li>
  <li>In the Azure Portal need to expose the API and add the front end WebApp as an "Authorized cient applications". </li>
  </ol>
  
  <p><img src="https://i.imgur.com/5mJjBuu.jpg" alt="screendump"></p>
  
  <p>This step will add a new object in the manifest file:</p>
  
  <pre><code>"preAuthorizedApplications": [
          {
              "appId": "guid",
              "permissionIds": [
                  "guid"
              ]
          }
      ],
  </code></pre>
  
  <ol start="5">
  <li><strong>But it's still not available throuh PowerShell!</strong> (<a href="https://docs.microsoft.com/en-us/powershell/module/azuread/set-azureadapplication?view=azureadps-2.0" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/powershell/module/azuread/set-azureadapplication?view=azureadps-2.0</a>)</li>
  </ol>
  
  <p>How can I add this "preAuthorizedApplications" section into the manifest file using Azure PowerShell? Why is it available in the portal but not in PS yet? It's the other way around usually...</p>
  
  <p><strong>08-05-2019 Update based on the answer:</strong></p>
  
  <p>I am getting the access token via a Service Principal:</p>
  
  <pre><code>$adTokenUrl = "https://login.microsoftonline.com/$TenantId/oauth2/token"
  $resource = "https://graph.windows.net/"
  
  $body = @{
      grant_type    = "client_credentials"
      client_id     = "$ServicePrincipalId"
      client_secret = "$ServicePrincipalKey"
      resource      = "$resource"
  }
  
  $response = Invoke-RestMethod -Method 'Post' -Uri $adTokenUrl -ContentType "application/x-www-form-urlencoded" -Body $body
  $token = $response.access_token
  
  </code></pre>
  
  <p>According to the docs: <a href="https://docs.microsoft.com/en-us/graph/api/application-update?view=graph-rest-beta&amp;tabs=cs" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/graph/api/application-update?view=graph-rest-beta&amp;tabs=cs</a></p>
  
  <p>The Service Principal should have at least Application.ReadWrite.OwnedBy, and most Application.ReadWrite.All privileges.</p>
  
  <p>Should I ask our AAD admin to grant the below rights to the Service Principal?</p>
  
  <p><img src="https://i.imgur.com/9arolWN.jpg" alt="screendump"></p>
  
  <p><br>
  <br></p>
  
  <p><strong>08-05-2019 Update 2: Service Principal has been granted with ALL of the highlighted rights above.</strong></p>
  
  <p><strong>Attempt 1:</strong> </p>
  
  <p><em>Step 1:</em> <em>getting an access_token via the Service Principal (Owner of the Api app to be updated)</em></p>
  
  <pre><code>$adTokenUrl = "https://login.microsoftonline.com/$(TenantId)/oauth2/token"
  $resource = "https://graph.microsoft.com/"
  
  $body = @{
      grant_type    = "client_credentials"
      client_id     = "$(ServicePrincipalId)"
      client_secret = "$(ServicePrincipalKey)"
      resource      = "$resource"
  }
  
  $response = Invoke-RestMethod -Method 'Post' -Uri $adTokenUrl -ContentType "application/x-www-form-urlencoded" -Body $body
  $token = $response.access_token
  </code></pre>
  
  <p><em>Step 2: using this access_token, building up my PATCH request as per Md Farid Uddin Kiron's suggestion, and</em></p>
  
  <blockquote>
    <p>Result: The remote server returned an error: (403) Forbidden.</p>
  </blockquote>
  
  <p><strong>09-05-2019 Update 3:</strong>  After some kind and detailed explanation and guidance, I got this to work and getting HTTP 204 for my Postman request. Only thing left is to integrate this steps into my pipeline.</p>
  
  <blockquote>
    <p><strong>See accepted answer</strong>. It works. If someone has the same issue,
    please read the other answer from Md Farid Uddin Kiron.</p>
  </blockquote>