title: What are the EXACT perms needed to use Get-AzureRmRoleAssignment as an app via a ServicePrincipal
body: <p>I've seen posts <a href="https://stackoverflow.com/questions/49695689/azure-graph-403-authorization-requestdenied-using-service-principal-from-vsts">like this one</a> where there is confusion on exactly what permission is required to allow a ServicePrincipal to call Get-AzureRmRoleAssignment when logging in using Login-AzureRmAccount. </p>
  
  <p>In my case if I call Get-AzureRmRoleAssignment with the -debug flag I can capture the following error in the body of the HTTP response:</p>
  
  <pre><code>Body:
  {
    "odata.error": {
      "code": "Authorization_RequestDenied",
      "message": {
        "lang": "en",
        "value": "Insufficient privileges to complete the operation."
      }
    }
  }
  </code></pre>
  
  <p>I have set perms for the application as follows... first the Azure AD access:</p>
  
  <p><a href="https://i.stack.imgur.com/UAs0U.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/UAs0U.png" alt="Azure AD perms"></a></p>
  
  <p>And then the Microsoft Graph access:</p>
  
  <p><a href="https://i.stack.imgur.com/INjbG.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/INjbG.png" alt="MS Graph perms"></a></p>
  
  <p>This still gives the authZ failure error. I have even tried an experiment where I gave the app ALL perms for each API, and that still did not work.</p>
  
  <p>What's missing? What perms EXACTLY are needed to allow read only programmatic access to list the role assignments with this call?</p>