import Global from '../../_global.mdx';
import Tabs from '@theme/Tabs';
import TabItem from '@theme/TabItem';

# entra app permission add

Adds the specified application and/or delegated permissions to a Microsoft Entra app

## Usage

```sh
m365 entra app permission add [options]
```

## Alias

```sh
m365 entra appregistration permission add [options]
```

## Options

```md definition-list
`-i, --appId [appId]`
: Client ID of the Microsoft Entra app to add the API permissions to. Specify either `appId`, `appName` or `appObjectId`.

`-n, --appName [appName]`
: Display name of the Microsoft Entra app to add the API permissions to. Specify either `appId`, `appName` or `appObjectId`.

`--appObjectId [appObjectId]`
: Object ID of the Microsoft Entra app to add the API permissions to. Specify either `appId`, `appName` or `appObjectId`.

`-a, --applicationPermissions [applicationPermissions]`
: Space-separated list of application permissions to add. Specify at least `applicationPermissions` or `delegatedPermissions`.

`-d, --delegatedPermissions [delegatedPermissions]`
: Space-separated list of delegated permissions to add. Specify at least `applicationPermissions` or `delegatedPermissions`.

`--grantAdminConsent`
: When specified, grants application & delegated permissions through admin consent.
```

<Global />

## Remarks

Scopes/Roles to grant must be fully-qualified so that we can disambiguate them between the different resources.

## Permissions

<Tabs>
  <TabItem value="Delegated">

  | Resource         | Permissions               |
  |------------------|---------------------------|
  | Microsoft Graph  | Application.ReadWrite.All |

  </TabItem>
  <TabItem value="Application">

  | Resource         | Permissions               |
  |------------------|---------------------------|
  | Microsoft Graph  | Application.ReadWrite.All |

  </TabItem>
</Tabs>

## Examples

Grant multiple delegated API permissions to a Microsoft Entra app specified by client id.

```sh
m365 entra app permission add --appId 'f1417aa3-bf0b-4cc5-a845-a0b2cf11f690' --delegatedPermissions 'https://management.azure.com/user_impersonation https://service.flow.microsoft.com/Flows.Read.All https://graph.microsoft.com/Agreement.Read.All'
```

Grant multiple delegated API permissions to a Microsoft Entra app specified by object id.

```sh
m365 entra app permission add --appObjectId 'e0306bb2-bf0b-4cc5-a845-a0b2cf11f690' --delegatedPermissions 'https://management.azure.com/user_impersonation https://service.flow.microsoft.com/Flows.Read.All https://graph.microsoft.com/Agreement.Read.All'
```

Grant multiple app-only permissions to a Microsoft Entra app specified by app display name and grant admin consent.

```sh
m365 entra app permission add --appName 'Contoso App' --applicationPermissions 'https://graph.microsoft.com/Sites.FullControl.All https://microsoft.sharepoint-df.com/Sites.FullControl.All' --grantAdminConsent
```

## Response

The command won't return a response on success.
