pnp / pnp/cli-microsoft365

New command 'entra enterpriseapp permission list' - Get a list of app-only and delegated permissions for an enterprise application

Open
#5,778 8 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

good first issue help wanted keep-open new feature
Dominant language
TypeScript
Stars
1.5k
Forks
413
Avg merge
5d 6h
Merged PRs (30d)
21

Description

Related to entra app permission list, but for enterprise applications / service principals

We currently have the following commands that cover listing permissions from an enterprise application / service principal:

This issue is for adding the same functionality in a more consistent way, that can in some time replace the oauthgrant and approleassignment commands.

We're also implementing a rename of entra serviceprincipal verb, which is why we're adding this in the correct command group right from the start.

Usage

m365 entra enterpriseapp permission list [options]

Description

Lists the application and delegated permissions for a specified Entra enterprise application

Options
Option Description
-i, --appId [appId] Client ID of the Entra enterprise app to retrieve the permissions for. Specify either appId, appName or appObjectId.
--appObjectId [appObjectId] Object ID of the Entra enterprise app to retrieve the permissions for. Specify either appId, appName or appObjectId.
-n, --appName [appName] Display name of the Entra enterprise app to retrieve the API permissions for. Specify either appId, appName or appObjectId.
--type [type] The type of permissions to retrieve. Allowed values: delegated, application, all. Defaults to all
Examples

Retrieves all permissions for an Entra enterprise application

m365 entra enterpriseapp permission list --appId 'f1417aa3-bf0b-4cc5-a845-a0b2cf11f690'

Retrieves all delegated permissions for an Entra enterprise application

m365 entra enterpriseapp permission list --appId 'f1417aa3-bf0b-4cc5-a845-a0b2cf11f690' --type delegated
Response
[
  {
    "resource": "Microsoft Graph",
    "resourceId": "00000003-0000-0000-c000-000000000000",
    "permission": "RecordsManagement.ReadWrite.All",
    "type": "Application"
  },
  {
    "resource": "Microsoft Graph",
    "resourceId": "00000003-0000-0000-c000-000000000000",
    "permission": "Sites.Read.All",
    "type": "Application"
  },
  {
    "resource": "Office 365 SharePoint Online",
    "resourceId": "00000003-0000-0ff1-ce00-000000000000",
    "permission": "AllSites.Read",
    "type": "Delegated"
  },
]
Additional information

If multiple apps with the same name exist, the CLI should show a disambiguation prompt to let the user choose.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by comparing the existing aad approleassignment list and aad oauth2grant list commands, then review the related entra app permission list and serviceprincipal rename issues. Confirm the new command supports the documented selectors, permission types, response shape, and disambiguation prompt for duplicate app names.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, cli, typescript
Domain
authorization, cli
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.