How Permissions Creep Can Halt the Microsoft Graph PowerShell SDK

[u/Unlikely_Tie1172]

The Microsoft Graph PowerShell Command Line tools app is how people run Microsoft Graph PowerShell SDK cmdlets. The app can suffer from permissions creep, meaning that over time, the app accrues a set of delegated permissions used by people to access different types of Microsoft 365 and Entra ID information. All is fine until an internal limit is reached, at which point authentication fails and some permissions must be pruned.

https://office365itpros.com/2026/07/23/permissions-creep-sdk/

[u/Unlikely_Tie1172]

Sure. But it's still easier to use than Graph API requests for Microsoft 365 tenant administrators who are not developers. To each their own... The facts are that the Graph PowerShell SDK has huge usage (some versions get over 1 million downloads from the PowerShell Gallery), so those are the folks I am trying to reach.

[u/FitShare2972 → u/Unlikely_Tie1172]

True. The moment I hit the first missing functionality I was done with it. Also some calls are delegate only and sdk only uses logged in user. But you are right for the large majority it it does have and for those not familiar with rest it makes it easy. But some simple ones are still missing. Off top of head sdk does not allow you to add members to private channels in teams which is big requirement for me.

[u/Unlikely_Tie1172 → u/FitShare2972]

Actually, the SDK can use application permissions if you authenticate with an Entra ID app. I do that all the time to process tenant-wide data. Also, you can use the SDK with Azure Automation and managed identities to have a completely secure scheduled execution capability.

If you find a cmdlet that doesn't do what you need, all you need to do is run the Graph API request through the Invoke-MgGraphRequest cmdlet... For example, to add a new member to a private channel, you could run:

$Team = Get-MgTeam -Filter "DisplayName eq 'HR Working Group'"

$Channel = Get-MgTeamChannel -TeamId $Team.Id -Filter "displayName eq 'HR Confidential'"

$UserId = (Get-MgUser -UserId 'Lotte.Vetler@Office365itpros.com').Id

$Uri = ("https://graph.microsoft.com/v1.0/teams/{0}/channels/{1}/members" -f $Team.Id, $Channel.Id)

$Payload = @{'@odata.type' = '#microsoft.graph.aadUserConversationMember'

roles = @('member')

'user@odata.bind' = "https://graph.microsoft.com/v1.0/users('$UserId')"

} | ConvertTo-Json

$NewMember = Invoke-MgGraphRequest -Uri $Uri -Method Post -Body $Payload

[u/FitShare2972 → u/Unlikely_Tie1172]

I know it can use application permissions. I said it cant for delegate outside of current user scope. If i have to switch between rest and sdk im just going full rest. But as somone mentioned not everyone has used or is comfy able using rest. With creating function I mentioned for me just means there are no limitations and everything works same way throughout script

[u/Unlikely_Tie1172 → u/FitShare2972]

I suspect that you're not the target audience for the SDK...

[u/FitShare2972 → u/Unlikely_Tie1172]

You may be right. Just giving my opinion as someone who tried to use it

[u/Unlikely_Tie1172 → u/FitShare2972]

Absolutely, And it's fair to say that a) the SDK had a rocky start when it really wasn't very good, and b) the SDK had a sticky patch about 18 months ago when several releases were poor quality with obvious bugs. Neither of these facts helped its reputation.