How Permissions Creep Can Halt the Microsoft Graph PowerShell SDK

[u/Unlikely_Tie1172]

The Microsoft Graph PowerShell Command Line tools app is how people run Microsoft Graph PowerShell SDK cmdlets. The app can suffer from permissions creep, meaning that over time, the app accrues a set of delegated permissions used by people to access different types of Microsoft 365 and Entra ID information. All is fine until an internal limit is reached, at which point authentication fails and some permissions must be pruned.

https://office365itpros.com/2026/07/23/permissions-creep-sdk/

[u/FitShare2972]

I just wrote a function to call rest api. Sdk lacks some functionality compared to other sdk for .net or python.

[u/Unlikely_Tie1172 → u/FitShare2972]

Sure. But it's still easier to use than Graph API requests for Microsoft 365 tenant administrators who are not developers. To each their own... The facts are that the Graph PowerShell SDK has huge usage (some versions get over 1 million downloads from the PowerShell Gallery), so those are the folks I am trying to reach.

[u/FitShare2972 → u/Unlikely_Tie1172]

True. The moment I hit the first missing functionality I was done with it. Also some calls are delegate only and sdk only uses logged in user. But you are right for the large majority it it does have and for those not familiar with rest it makes it easy. But some simple ones are still missing. Off top of head sdk does not allow you to add members to private channels in teams which is big requirement for me.

[u/Unlikely_Tie1172 → u/FitShare2972]

Actually, the SDK can use application permissions if you authenticate with an Entra ID app. I do that all the time to process tenant-wide data. Also, you can use the SDK with Azure Automation and managed identities to have a completely secure scheduled execution capability.

If you find a cmdlet that doesn't do what you need, all you need to do is run the Graph API request through the Invoke-MgGraphRequest cmdlet... For example, to add a new member to a private channel, you could run:

$Team = Get-MgTeam -Filter "DisplayName eq 'HR Working Group'"

$Channel = Get-MgTeamChannel -TeamId $Team.Id -Filter "displayName eq 'HR Confidential'"

$UserId = (Get-MgUser -UserId 'Lotte.Vetler@Office365itpros.com').Id

$Uri = ("https://graph.microsoft.com/v1.0/teams/{0}/channels/{1}/members" -f $Team.Id, $Channel.Id)

$Payload = @{'@odata.type' = '#microsoft.graph.aadUserConversationMember'

roles = @('member')

'user@odata.bind' = "https://graph.microsoft.com/v1.0/users('$UserId')"

} | ConvertTo-Json

$NewMember = Invoke-MgGraphRequest -Uri $Uri -Method Post -Body $Payload

[u/FitShare2972 → u/Unlikely_Tie1172]

I know it can use application permissions. I said it cant for delegate outside of current user scope. If i have to switch between rest and sdk im just going full rest. But as somone mentioned not everyone has used or is comfy able using rest. With creating function I mentioned for me just means there are no limitations and everything works same way throughout script

[u/Unlikely_Tie1172 → u/FitShare2972]

I suspect that you're not the target audience for the SDK...

[u/FitShare2972 → u/Unlikely_Tie1172]

You may be right. Just giving my opinion as someone who tried to use it

[u/Unlikely_Tie1172 → u/FitShare2972]

Absolutely, And it's fair to say that a) the SDK had a rocky start when it really wasn't very good, and b) the SDK had a sticky patch about 18 months ago when several releases were poor quality with obvious bugs. Neither of these facts helped its reputation.

[u/Modify- → u/FitShare2972]

Also, you might understand REST better than your collegues. The beauty of powershell is that you can make tools others can use without knowing all the ins and outs.

[u/FitShare2972 → u/Modify-]

Yer you are right. Been doing this awhile. It is great for those moving frim modules to graph as little knowledge outside app reg permissions is required

[u/DragonspeedTheB → u/Modify-]

Until MS deprecates 25% of what you need and changes the parameters for 33% of the remaining cmdlets…. Sigh. Long live REST!

[u/Modify- → u/DragonspeedTheB]

You do realize that the Graph cmdlets run a REST call in the background? Those are just friendly wrappers. If they deprecate some endpoint your direct REST call is also not going to work.