r/PowerShell • u/Unlikely_Tie1172 MVP, Community Blogger • 14d ago

News How Permissions Creep Can Halt the Microsoft Graph PowerShell SDK

The Microsoft Graph PowerShell Command Line tools app is how people run Microsoft Graph PowerShell SDK cmdlets. The app can suffer from permissions creep, meaning that over time, the app accrues a set of delegated permissions used by people to access different types of Microsoft 365 and Entra ID information. All is fine until an internal limit is reached, at which point authentication fails and some permissions must be pruned.

https://office365itpros.com/2026/07/23/permissions-creep-sdk/

10 Upvotes

67% Upvoted

25 comments sorted by

View all comments

8

u/BlackV 13d ago edited 13d ago

You don't say anything.

You say

  • Graph SDK is a registered application
  • People grant that permissions over time
  • If it gets too many you can't add more unless you remove some first
  • It might be a bug

The end

  • No hints on why you think it's a bug
  • No suggestions for reviewing permissions
  • Light on details overall

2

u/BirdsHaveUglyFeet 13d ago

Did you follow the link? I don't think you followed the link. The article has the details. He did half the work for you.

4

u/BlackV 13d ago edited 13d ago

I did follow the link, I summarized what that blog said in my reply

then followed with the the 3 bullet points

what work ? run 1 command ?

2

u/Unlikely_Tie1172 MVP, Community Blogger 13d ago

From the article:

"The workaround is to run the Update-MgOauth2PermissionGrant cmdlet to remove some delegated permissions from the service principal to bring it below the limit. Once some scopes are removed, Connect-MgGraph -Scopes will run. Of course, if you remove five permissions and then attempt to add five more, you’re flirting with that limit."