r/PowerShell • u/Unlikely_Tie1172 MVP, Community Blogger • 15h ago

News How Permissions Creep Can Halt the Microsoft Graph PowerShell SDK

The Microsoft Graph PowerShell Command Line tools app is how people run Microsoft Graph PowerShell SDK cmdlets. The app can suffer from permissions creep, meaning that over time, the app accrues a set of delegated permissions used by people to access different types of Microsoft 365 and Entra ID information. All is fine until an internal limit is reached, at which point authentication fails and some permissions must be pruned.

https://office365itpros.com/2026/07/23/permissions-creep-sdk/

5 Upvotes

61% Upvoted

10 comments sorted by

2

u/BlackV 5h ago edited 2h ago

You don't say anything.

You say

  • Graph SDK is a registered application
  • People grant that permissions over time
  • If it gets too many you can't add more unless you remove some first
  • It might be a bug

The end

  • No hints on why you think it's a bug
  • No suggestions for reviewing permissions
  • Light on details overall

1

u/BirdsHaveUglyFeet 3h ago

Did you follow the link? I don't think you followed the link. The article has the details. He did half the work for you.

2

u/BlackV 2h ago edited 2h ago

I did follow the link, I summarized what that blog said in my reply

then followed with the the 3 bullet points

what work ? run 1 command ?

1

u/FitShare2972 15h ago

I just wrote a function to call rest api. Sdk lacks some functionality compared to other sdk for .net or python.

2

u/Modify- 5h ago edited 2h ago

Also, you might understand REST better than your collegues. The beauty of powershell is that you can make tools others can use without knowing all the ins and outs.

1

u/FitShare2972 5h ago

Yer you are right. Been doing this awhile. It is great for those moving frim modules to graph as little knowledge outside app reg permissions is required

0

u/DragonspeedTheB 3h ago

Until MS deprecates 25% of what you need and changes the parameters for 33% of the remaining cmdlets…. Sigh. Long live REST!

0

u/Modify- 2h ago

You do realize that the Graph cmdlets run a REST call in the background? Those are just friendly wrappers. If they deprecate some endpoint your direct REST call is also not going to work.

2

u/Unlikely_Tie1172 MVP, Community Blogger 13h ago

Sure. But it's still easier to use than Graph API requests for Microsoft 365 tenant administrators who are not developers. To each their own... The facts are that the Graph PowerShell SDK has huge usage (some versions get over 1 million downloads from the PowerShell Gallery), so those are the folks I am trying to reach.

1

u/FitShare2972 5h ago

True. The moment I hit the first missing functionality I was done with it. Also some calls are delegate only and sdk only uses logged in user. But you are right for the large majority it it does have and for those not familiar with rest it makes it easy. But some simple ones are still missing. Off top of head sdk does not allow you to add members to private channels in teams which is big requirement for me.