title: Powershell AzureAD App Registration Permissions New-AzureADApplication -RequiredResourceAccess
body: <p>I am having a problem with the following code. I am trying to assign the following permissions to an App Registration in AzureAD using the -RequiredResourceAccess  property from New-AzureADApplication. I keep getting an invalid value for $reqGraph?</p>
  <p>Please help?</p>
  <blockquote>
  <p>New-AzureADApplication : Error occurred while executing NewApplication
  Code: Request_BadRequest Message: Invalid value specified for property
  'resourceAppId' of resource 'RequiredResourceAccess'. RequestId:
  5abf5ea5-8f94-4d14-8e8d-8f12a92bf3e5 DateTimeStamp: Mon, 17 May 2021
  07:12:02 GMT Details: PropertyName  - resourceAppId, PropertyErrorCode</p>
  <ul>
  <li>InvalidValue HttpStatusCode: BadRequest HttpStatusDescription: Bad Request HttpResponseStatus: Completed</li>
  </ul>
  </blockquote>
  <pre><code>$appName = &quot;Test&quot; # Maximum 32 characters
  $adalUrlIdentifier = &quot;https://abc.dk/AADGuestLifecycleMgmt&quot;
  $appReplyUrl = &quot;https://www.abc.dk&quot;
  $pwd = Read-Host -Prompt 'Enter a secure password for your certificate!'
  $certStore = &quot;Cert:\CurrentUser\My&quot;
  $currentDate = Get-Date
  $endDate = $currentDate.AddYears(10) # 10 years is nice and long
  $thumb = (New-SelfSignedCertificate -DnsName &quot;abc.dk&quot; -CertStoreLocation $certStore -KeyExportPolicy Exportable -Provider &quot;Microsoft Enhanced RSA and AES Cryptographic Provider&quot; -NotAfter $endDate).Thumbprint
  $thumb &gt; cert-thumb.txt # Save to file
  $pwd = ConvertTo-SecureString -String $pwd -Force -AsPlainText
  Export-PfxCertificate -cert &quot;$certStore\$thumb&quot; -FilePath .\AzureADGuestLifecycleMgmt.pfx -Password $pwd
  $path = (Get-Item -Path &quot;.\&quot;).FullName
  $cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate(&quot;$path\AzureADGuestLifecycleMgmt.pfx&quot;, $pwd)
  $keyValue = [System.Convert]::ToBase64String($cert.GetRawCertData())
  
  Install-Module AzureAD
  Import-Module AzureAD
  # Connect to Azure AD as an admin account
  Connect-AzureAD 
  
  # Store tenantid
  $tenant = Get-AzureADTenantDetail
  $tenant.ObjectId &gt; tenantid.txt
  
  # Add AuditLog.Read.All access
  $svcPrincipal = Get-AzureADServicePrincipal -All $true | ? { $_.DisplayName -match &quot;Microsoft Graph&quot; }
  $appRole = $svcPrincipal.AppRoles | ? { $_.Value -eq &quot;AuditLog.Read.All&quot; }
  $appPermission = New-Object -TypeName &quot;Microsoft.Open.AzureAD.Model.ResourceAccess&quot; -ArgumentList &quot;$($appRole.Id)&quot;, &quot;Role&quot;
  
  #Add Directory.ReadWrite.All access
  $appRole2 = $svcPrincipal.AppRoles | ? { $_.Value -eq &quot;Directory.ReadWrite.All&quot; }
  $appPermission2 = New-Object -TypeName &quot;Microsoft.Open.AzureAD.Model.ResourceAccess&quot; -ArgumentList &quot;$($appRole2.Id)&quot;, &quot;Role&quot;
  
  $reqGraph = New-Object -TypeName &quot;Microsoft.Open.AzureAD.Model.RequiredResourceAccess&quot;
  $reqGraph.ResourceAppId = $svcPrincipal.AppId
  $reqGraph.ResourceAccess = $appPermission, $appPermission2
  
  Write-Host $reqGraph
  
  # Create Azure Active Directory Application (ADAL App)
  $application = New-AzureADApplication -DisplayName &quot;$appName&quot; -IdentifierUris $adalUrlIdentifier -ReplyUrls $appReplyUrl -RequiredResourceAccess $reqGraph
  New-AzureADApplicationKeyCredential -ObjectId $application.ObjectId -CustomKeyIdentifier &quot;$appName&quot; -Type AsymmetricX509Cert -Usage Verify -Value $keyValue -StartDate $currentDate -EndDate $endDate.AddDays(-1)
  </code></pre>