Find Azure Service Principal permissions using Azure Powershell cmdlets - azure

Question

I'm trying to create a custom role for a service principal in Azure for an automation script that runs on Azure Powershell.
I have the cmdlets, but is there a fastest way to find what permission every cmdlet needs rather than search for every permission in the full list of Azure Built-in Roles and "guess" what is the right permission or not?

Answer 1

If you take a look at the mgGraph cmdlets (install-module microsoft.graph) you get the cmdlet find-mggraphCommand which tells you what permissions are needed to run a specific cmdlet, e.g.:
(Find-MgGraphCommand -command new-MgUser).permissions
Name IsAdmin Description FullDescription
---- ------- ----------- ---------------
DeviceManagementApps.ReadWrite.All True Read and write Microsoft Intune apps Allows the app to read and write the properties, group assignments and status of apps, app configurations and app protection policies managed by Microsoft Intune.
DeviceManagementManagedDevices.ReadWrite.All True Read and write Microsoft Intune devices Allows the app to read and write the properties of devices managed by Microsoft Intune. Does not allow high impact operations such as remote wipe and password reset on the device’s owner.
DeviceManagementServiceConfig.ReadWrite.All True Read and write Microsoft Intune configuration Allows the app to read and write Microsoft Intune service properties including device enrollment and third party service connection configuration.
Directory.ReadWrite.All True Read and write directory data Allows the app to read and write data in your organization's directory, such as other users, groups. It does not allow the app to delete users or groups, or reset user passwords.
User.ReadWrite.All True Read and write all users' full profiles Allows the app to read and write the full set of profile properties, reports, and managers of other users in your organization, on your behalf.
DeviceManagementApps.ReadWrite.All True Read and write Microsoft Intune apps Allows the app to read and write the properties, group assignments and status of apps, app configurations and app protection policies managed by Microsoft Intune.
DeviceManagementManagedDevices.ReadWrite.All True Read and write Microsoft Intune devices Allows the app to read and write the properties of devices managed by Microsoft Intune. Does not allow high impact operations such as remote wipe and password reset on the device’s owner.
DeviceManagementServiceConfig.ReadWrite.All True Read and write Microsoft Intune configuration Allows the app to read and write Microsoft Intune service properties including device enrollment and third party service connection configuration.
Directory.ReadWrite.All True Read and write directory data Allows the app to read and write data in your organization's directory, such as other users, groups. It does not allow the app to delete users or groups, or reset user passwords.
User.ReadWrite.All True Read and write all users' full profiles Allows the app to read and write the full set of profile properties, reports, and managers of other users in your organization, on your behalf.