We currently have the following commands that cover removing permissions from an app:

• aad approleassignment remove but that only removes app-only permissions from service principals, not from App Registrations.
• aad oauth2grant remove but that only removes delegated permissions from service principals, not from App Registrations.

So it would be useful if we add another command to be able to easily remove permissions from App Registrations just using options.

Usage

m365 entra app permission remove [options]

Description

Removes the specified application and/or delegated permissions from a specified Entra app

Options

Remarks

Removing permissions on App Registrations does not immediately remove consent given by an administrator. Explicitly instruct the CLI to revoke consent by using the --revokeAdminConsent flag.

Examples

Remove multiple delegated API permissions from an Entra app registration

m365 entra app permission remove --appId 'f1417aa3-bf0b-4cc5-a845-a0b2cf11f690' --delegatedPermissions 'https://management.azure.com/user_impersonation https://service.flow.microsoft.com/Flows.Read.All https://graph.microsoft.com/Agreement.Read.All'

Remove multiple app-only permissions from an Entra app registration and revoke admin consent

m365 entra app permission remove --appId 'f1417aa3-bf0b-4cc5-a845-a0b2cf11f690' --applicationPermissions 'https://graph.microsoft.com/Sites.FullControl.All https://microsoft.sharepoint-df.com/Sites.FullControl.All' --revokeAdminConsent

Additional information

If multiple apps with the same name exist, the CLI should show a disambiguation prompt to let the user choose.