New command 'entra enterpriseapp permission list' - Get a list of app-only and delegated permissions for an enterprise application
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 1.5k
- Forks
- 413
- Avg merge
- 5d 6h
- Merged PRs (30d)
- 21
Description
Related to entra app permission list, but for enterprise applications / service principals
We currently have the following commands that cover listing permissions from an enterprise application / service principal:
This issue is for adding the same functionality in a more consistent way, that can in some time replace the oauthgrant and approleassignment commands.
We're also implementing a rename of entra serviceprincipal verb, which is why we're adding this in the correct command group right from the start.
Usage
m365 entra enterpriseapp permission list [options]
Description
Lists the application and delegated permissions for a specified Entra enterprise application
Options
| Option | Description |
|---|---|
-i, --appId [appId] |
Client ID of the Entra enterprise app to retrieve the permissions for. Specify either appId, appName or appObjectId. |
--appObjectId [appObjectId] |
Object ID of the Entra enterprise app to retrieve the permissions for. Specify either appId, appName or appObjectId. |
-n, --appName [appName] |
Display name of the Entra enterprise app to retrieve the API permissions for. Specify either appId, appName or appObjectId. |
--type [type] |
The type of permissions to retrieve. Allowed values: delegated, application, all. Defaults to all |
Examples
Retrieves all permissions for an Entra enterprise application
m365 entra enterpriseapp permission list --appId 'f1417aa3-bf0b-4cc5-a845-a0b2cf11f690'
Retrieves all delegated permissions for an Entra enterprise application
m365 entra enterpriseapp permission list --appId 'f1417aa3-bf0b-4cc5-a845-a0b2cf11f690' --type delegated
Response
[
{
"resource": "Microsoft Graph",
"resourceId": "00000003-0000-0000-c000-000000000000",
"permission": "RecordsManagement.ReadWrite.All",
"type": "Application"
},
{
"resource": "Microsoft Graph",
"resourceId": "00000003-0000-0000-c000-000000000000",
"permission": "Sites.Read.All",
"type": "Application"
},
{
"resource": "Office 365 SharePoint Online",
"resourceId": "00000003-0000-0ff1-ce00-000000000000",
"permission": "AllSites.Read",
"type": "Delegated"
},
]
Additional information
If multiple apps with the same name exist, the CLI should show a disambiguation prompt to let the user choose.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by comparing the existing aad approleassignment list and aad oauth2grant list commands, then review the related entra app permission list and serviceprincipal rename issues. Confirm the new command supports the documented selectors, permission types, response shape, and disambiguation prompt for duplicate app names.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, cli, typescript
- Domain
- authorization, cli
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100