如何从 Microsoft Entra 中的应用程序删除权限

Jacki

2023-11-08

因此，您在 Microsoft Entra 中拥有所有这些应用程序（企业应用程序和应用程序注册）。但您想撤销应用程序的权限。可以从 Microsoft Entra 管理中心的应用程序中删除管理员同意权限，但不能删除用户同意权限。在本文中，您将了解如何从 Microsoft Entra 应用程序中删除管理员和用户同意权限。

让我们看看 Microsoft Entra 中应用程序的管理员同意和用户同意权限：

登录到微软 Entra 管理中心
扩张身份 > 应用
选择企业应用程序（或App注册）
点击所有应用程序
选择应用

点击权限
选择管理员同意
选择撤销权限

单击用户同意选项卡
没有选择撤销权限

因此，当通过管理员同意授予应用程序权限时，我们可以撤销应用程序的权限。不幸的是，当通过 Microsoft Entra 管理中心的用户同意授予权限时，无法撤销权限。

在下一步中，我们将完成这些步骤并展示如何使用 PowerShell 从应用程序中删除管理员和用户同意权限。

安装 Microsoft Graph PowerShell 模块

以管理员身份启动 Windows PowerShell 并安装 Microsoft Graph PowerShell。

Install-Module Microsoft.Graph -Force

重要的：在运行 cmdlet 或脚本之前，请务必更新到最新的 Microsoft Graph PowerShell 模块版本，以防止出现错误和不正确的结果。

您可以使用下面的脚本来删除两者用户和管理员同意权限从应用程序。

找到应用程序对象ID在“概述”选项卡中。接下来，将其粘贴到4号线。

Connect-MgGraph -Scopes "User.ReadWrite.All", "Application.ReadWrite.All", "DelegatedPermissionGrant.ReadWrite.All"

# Get Service Principal using objectId
$sp = Get-MgServicePrincipal -ServicePrincipalId 453d37f9-20e5-4325-bc00-67d1581a0232

# Get all delegated permissions for the service principal
$spOAuth2PermissionsGrants = Get-MgServicePrincipalOauth2PermissionGrant -ServicePrincipalId $sp.Id -All

# Remove all delegated permissions
$spOAuth2PermissionsGrants | ForEach-Object {
    Remove-MgOauth2PermissionGrant -OAuth2PermissionGrantId $_.Id
}

仅删除管理员同意权限从应用程序。

找到应用程序对象ID在“概述”选项卡中。接下来，将其粘贴到4号线。

Connect-MgGraph -Scopes "User.ReadWrite.All", "Application.ReadWrite.All", "DelegatedPermissionGrant.ReadWrite.All"

# Get Service Principal using objectId
$sp = Get-MgServicePrincipal -ServicePrincipalId 453d37f9-20e5-4325-bc00-67d1581a0232

# Get all delegated permissions for the service principal
$spOAuth2PermissionsGrants = Get-MgServicePrincipalOauth2PermissionGrant -ServicePrincipalId $sp.Id -All

# Remove only delegated permissions granted with admin consent
$spOAuth2PermissionsGrants | Where-Object { $_.ConsentType -eq "AllPrincipals" } | ForEach-Object {
    Remove-MgOauth2PermissionGrant -OAuth2PermissionGrantId $_.Id
}

仅删除用户同意权限从应用程序。

找到应用程序对象ID在“概述”选项卡中。接下来，将其粘贴到4号线。

Connect-MgGraph -Scopes "User.ReadWrite.All", "Application.ReadWrite.All", "DelegatedPermissionGrant.ReadWrite.All"

# Get Service Principal using objectId
$sp = Get-MgServicePrincipal -ServicePrincipalId 453d37f9-20e5-4325-bc00-67d1581a0232

# Get all delegated permissions for the service principal
$spOAuth2PermissionsGrants = Get-MgServicePrincipalOauth2PermissionGrant -ServicePrincipalId $sp.Id -All

# Remove only delegated permissions granted with user consent
$spOAuth2PermissionsGrants | Where-Object { $_.ConsentType -ne "AllPrincipals" } | ForEach-Object {
    Remove-MgOauth2PermissionGrant -OAuth2PermissionGrantId $_.Id
}

让我们看看使用 PowerShell 脚本删除 Microsoft Entra 应用程序权限的更好方法。

使用 Powershell 脚本删除 Entra ID 应用程序权限

删除用户和管理员同意权限的一个好方法是使用 PowerShell 脚本。

准备Remove-AppPermissions PowerShell脚本

下载Remove-AppPermissions.ps1 PowerShell脚本并将其放置在C：脚本文件夹。

确保文件未被阻止，以防止运行脚本时出现错误。请阅读文章运行 PowerShell 脚本时出现未数字签名错误来了解更多信息。

另一种选择是将以下代码复制并粘贴到记事本中。给它起个名字删除-AppPermissions.ps1并将其放置在C：脚本文件夹。

<#
    .SYNOPSIS
    Remove-AppPermissions.ps1

    .DESCRIPTION
    Remove app permissions from a Microsoft Entra ID application in a tenant.

    .LINK
    www.alitajran.com/remove-permissions-applications/

    .NOTES
    Written by: ALI TAJRAN
    Website:    alitajran.com
    X:          x.com/alitajran
    LinkedIn:   linkedin.com/in/alitajran

    .CHANGELOG
    V1.00, 11/08/2023 - Initial version
    V1.10, 10/07/2024 - Cleaned up the code
#>

# Variables
$systemMessageColor = "cyan"
$processMessageColor = "green"
$errorMessageColor = "red"
$warningMessageColor = "yellow"

Write-Host "Script started" -ForegroundColor $systemMessageColor
Write-Host "Script to delete app permissions from an Entra ID application in a tenant" -ForegroundColor $systemMessageColor

Write-Host "Checking for Microsoft Graph PowerShell module" -ForegroundColor $processMessageColor
if (Get-Module -ListAvailable -Name Microsoft.Graph.Authentication) {
    Write-Host -ForegroundColor $processMessageColor "Microsoft Graph PowerShell module found"
}
else {
    Write-Host "Microsoft Graph PowerShell Module not installed. Please install and re-run the script" -ForegroundColor $warningMessageColor -BackgroundColor $errorMessageColor
    Write-Host "You can install the Microsoft Graph PowerShell module by:"
    Write-Host "1. Launching an elevated PowerShell console then,"
    Write-Host "2. Running the command, 'Install-Module -Name Microsoft.Graph'."
    Pause ## Pause to view error on screen
    exit 0 ## Terminate script
}

Connect-MgGraph -Scopes "User.ReadWrite.All", "Application.ReadWrite.All", "DelegatedPermissionGrant.ReadWrite.All" -NoWelcome

$results = Get-MgServicePrincipal -All | Select-Object Id, AppId, DisplayName | Sort-Object DisplayName | Out-GridView -PassThru -Title "Select Application (Multiple selections permitted)"
foreach ($result in $results) {
    # Loop through all selected options
    Write-Host "Commencing" $result.DisplayName -ForegroundColor $processMessageColor
    # Get Service Principal using objectId
    $sp = Get-MgServicePrincipal -All | Where-Object { $_.Id -eq $result.Id }
    # Menu selection for User or Admin consent types
    $consentType = [System.Collections.Generic.List[Object]]::new()
    $consentType.Add([PSCustomObject]@{ Name = "Admin consent"; Type = "allprincipals" })
    $consentType.Add([PSCustomObject]@{ Name = "User consent"; Type = "principal" })
    $consentSelects = $consentType | Out-GridView -PassThru -Title "Select Consent type (Multiple selections permitted)"

    foreach ($consentSelect in $consentSelects) {
        # Loop through all selected options
        Write-Host  "Commencing for" $consentSelect.Name -ForegroundColor $processMessageColor
        # Get all delegated permissions for the service principal
        $spOAuth2PermissionsGrants = Get-MgOauth2PermissionGrant -All | Where-Object { $_.clientId -eq $sp.Id }
        $info = $spOAuth2PermissionsGrants | Where-Object { $_.consentType -eq $consentSelect.Type }

        if ($info) {
            # If there are permissions set
            if ($consentSelect.Type -eq "principal") {
                # User consent
                $usernames = [System.Collections.Generic.List[Object]]::new()
                foreach ($item in $info) {
                    $usernames.Add((Get-MgUser -UserId $item.PrincipalId))
                }
                $selectUsers = $usernames | Select-Object Displayname, UserPrincipalName, Id | Sort-Object Displayname | Out-GridView -PassThru -Title "Select Consent type (Multiple selections permitted)"
                foreach ($selectUser in $selectUsers) {
                    # Loop through all selected options
                    $infoScopes = $info | Where-Object { $_.principalId -eq $selectUser.Id }
                    Write-Host $consentSelect.Name "permissions for user" $selectUser.Displayname -ForegroundColor $processMessageColor
                    foreach ($infoScope in $infoScopes) {
                        Write-Host "Resource ID =", $infoScope.ResourceId
                        $assignments = $infoScope.Scope -split " "
                        foreach ($assignment in $assignments) {
                            # Skip empty strings
                            if ($assignment -ne "") {
                                Write-Host "-", $assignment
                            }
                        }
                    }
                    Write-Host "Select items to remove" -ForegroundColor $processMessageColor
                    $removes = $infoScopes | Select-Object Scope, ResourceId, Id | Out-GridView -PassThru -Title "Select permissions to delete (Multiple selections permitted)"
                    foreach ($remove in $removes) {
                        Remove-MgOauth2PermissionGrant -OAuth2PermissionGrantId $remove.Id
                        Write-Host "Removed consent for $($remove.Scope)" -ForegroundColor $warningMessageColor
                    }
                }
            }
            elseif ($consentSelect.Type -eq "allprincipals") {
                # Admin consent
                $infoScopes = $info | Where-Object { $_.principalId -eq $null }
                Write-Host $consentSelect.Name "permissions" -ForegroundColor $processMessageColor
                foreach ($infoScope in $infoScopes) {
                    Write-Host "Resource ID =", $infoScope.ResourceId
                    $assignments = $infoScope.Scope -split " "
                    foreach ($assignment in $assignments) {
                        # Skip empty strings
                        if ($assignment -ne "") {
                            Write-Host "-", $assignment
                        }
                    }
                }
                Write-Host "Select items to remove" -ForegroundColor $processMessageColor
                $removes = $infoScopes | Select-Object Scope, ResourceId, Id | Out-GridView -PassThru -Title "Select permissions to delete (Multiple selections permitted)"
                foreach ($remove in $removes) {
                    Remove-MgOauth2PermissionGrant -OAuth2PermissionGrantId $remove.Id
                    Write-Host "Removed consent for $($remove.Scope)" -ForegroundColor $warningMessageColor
                }
            }
        }
        else {
            Write-Host "No" $consentSelect.Name "permissions found for" $results.DisplayName -ForegroundColor $warningMessageColor
        }
    }
}

Write-Host "Script Finished" -ForegroundColor $systemMessageColor