Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To limit who can use Microsoft Graph PowerShell and which permissions they can consent to, register a custom app in your Microsoft Entra directory, configure its authentication redirects, require assignment, and connect with that app’s client ID. Use delegated access for interactive work when it meets the need; reserve app-only access for unattended jobs that need an app identity, and grant only the permissions each task requires.
Choose the access model before creating an app
Microsoft Graph PowerShell supports delegated and app-only authentication. Both begin with Connect-MgGraph, but they represent different identities and permission boundaries.
| Model | Identity and access boundary | Typical fit | Consent and credential considerations |
|---|---|---|---|
| Delegated | Acts on behalf of a signed-in user; access is bounded by the granted scopes and the user’s own access. | Interactive administration where a user signs in. | Use a custom app registration to isolate and limit consent permissions. You can require assignment to control which users or groups may use the enterprise application. |
| App-only | Acts as the application without a signed-in user and can access data represented by its granted application permissions. | Unattended scripts and services. | Application permissions are highly privileged and require administrator consent. Microsoft’s PowerShell guidance describes certificate-based credentials. |
Microsoft recommends delegated permissions whenever they satisfy the workload. A separate app registration is a way to scope consent and access; it does not make a broad permission least-privileged by itself. See Microsoft’s Graph permissions overview (last updated December 26, 2025) for permission concepts.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesSet up a custom app for delegated Graph PowerShell
Microsoft documents custom delegated applications as an approach to isolating and limiting consent permissions for Graph PowerShell. The app registration belongs in your organization’s Entra directory. Follow the current Microsoft Graph PowerShell authentication guide for the portal labels and redirect URI details; it specifies a http://localhost public-client redirect URI and an additional Windows Authentication Manager broker redirect URI.
#1 Best Overall
- Book - powershell for sysadmins: workflow automation made easy
- Language: english
- Binding: paperback
- Register the app. In the Microsoft Entra admin center, create an app registration in the organization’s directory. Configure the public-client redirect URI and broker redirect URI as instructed in Microsoft’s current authentication guide.
- Gate access by assignment. Open the corresponding enterprise application, set Assignment required? to Yes, and assign only the permitted users or groups. This is the documented launch-access gate; keep the assignment list aligned with who should use the app.
- Connect with the app and tenant IDs. In PowerShell, use the custom app’s client ID and your tenant ID:
Connect-MgGraph -ClientId <YOUR_NEW_APP_ID> -TenantId <YOUR_TENANT_ID>This is the command shape in Microsoft’s custom delegated app instructions. It does not grant every Graph permission: make sure the scopes needed for the operation are configured and consented under your tenant’s policy. The authenticated user’s own access remains an additional boundary.
Use app-only access for unattended scripts
For a job that must run without an interactive user, Microsoft’s app-only authentication guide describes registering an application, configuring the permission scopes required by the scenario, uploading the certificate’s public key, and connecting with the application ID and tenant ID. App-only permissions belong to the application, not to a signed-in operator, and require administrator consent.
Connect-MgGraph -ClientID <APP_ID> -TenantId <TENANT_ID> -CertificateThumbprint <CERT_THUMBPRINT>That certificate-thumbprint form is documented by Microsoft. The authentication reference also documents -CertificateName and certificate-object forms. Because cmdlet parameters and module behavior can change, check the current Connect-MgGraph reference and the installed module version before putting a command into production.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Choose permissions by task, not by app name
Graph permission names commonly describe the resource, operation, and constraint. For example, Microsoft identifies Application.ReadWrite.OwnedBy as a permission limited to applications the app creates or owns. That narrower scope is meaningful because of its stated constraint—not simply because it belongs to a separate registration.
Be especially careful if a workflow manages permission grants. Microsoft’s grant and revoke permissions guidance warns that DelegatedPermissionGrant.ReadWrite.All and AppRoleAssignment.ReadWrite.All can manage grants and elevate privileges across apps, users, or groups in an organization. Do not put these grant-management permissions in an everyday operator app unless its duties genuinely require them.
- For interactive work, prefer delegated scopes when they are sufficient, and consider a custom app when you need to isolate consent for Graph PowerShell.
- For unattended work, select only the application permissions the job requires and protect its certificate credential.
- Keep app registration, enterprise-app assignment, permission grants, and the user or workload’s actual task aligned; none of these controls substitutes for least privilege in the others.
Validate the configuration in your tenant
Microsoft’s documentation describes the configuration and command forms; it does not establish that a particular tenant has implemented them correctly. After setup, verify that the enterprise application requires assignment and that only intended users or groups are assigned. Confirm the app’s granted permissions and consent against the job’s needs, then test authentication and the intended Graph operation with an appropriately scoped account or workload.
Rank #4
- Used Book in Good Condition
Portal navigation, tenant consent policy, and authentication cmdlets may change. Use the current Microsoft Learn guidance and the documentation for the Graph PowerShell version installed in your environment when implementing or troubleshooting.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
