title: How to export delegated permissions and application permissions for azure app registrations using graph api
body: <p>I'm working on a script to export into a csv both <code>delegated permissions</code> and <code>application permissions</code> for all of my azure app registrations using <code>graph api</code> requests.</p>
  <p>In my script,</p>
  <p>step 1, i'm exporting all available app registrations, then create a custom ps object named <code>$Data</code>.</p>
  <p>Step 2, i'm filtering the list of all app registrations with delegated permissions(permission type equal Scope) to a variable <code>$perms</code>.</p>
  <p>Step3, a graph api request to grab all service principals in azure then add to a ps object called <code>$sp_data</code></p>
  <p>Step 4, I'm looping <code>$perms</code> object(this object holds apps with only delegated permissions) and filter service principal object <code>$sp_data</code> that has all available <code>delegated permissions</code> to remain with only apps with only delegated permissions and the permission value., then complete by exporting to csv file.</p>
  <p><strong>Issue</strong></p>
  <p>My script only returns values for one app registration with delegated permissions, instead of all apps. I need assistance to make sure the script can export delegated permissions and application permissions associated with its respective app registration.</p>
  <p>Below is my entire script so far</p>
  <pre><code># Install MSAL.ps module first &amp; register an app in azure
  # The application to use here must have application.readall and directory.readall permissions assigned
  $connectiondetails = @{
      # Application (client) ID here
   'clientid' = &quot;&quot;
  
   # Tenant ID here
   'tenantid' = &quot;&quot;
  
   # Secret id here
   'clientSecret' = &quot;&quot; | ConvertTo-SecureString -AsPlainText -Force
  
  }
  
  
  $token = Get-MsalToken @connectiondetails
  $tokenid_ = $token.AccessToken
  
  # specify where directory to store the csv files here
  $delegatedperms = &quot;C:\temp\delegatedpermissions.csv&quot;
  $applicationperms = &quot;C:\temp\applicationpermissions.csv&quot;
  
  # Access token from azure ad oauth app
  $accessToken = $tokenid_
  
  # Grab all applications without leaving any app behind.
  $all_apps = &quot;https://graph.microsoft.com/v1.0/applications&quot;
  
  $results = Invoke-RestMethod -Method get -Uri $all_apps -ContentType &quot;application/json&quot; -Headers @{Authorization=(&quot;bearer {0}&quot; -f $accessToken)}
  
  # $results
  $Data = foreach($res in $results.value){
  
     ForEach($Access in $res.RequiredResourceAccess){
          foreach ($Permission in $Access.ResourceAccess) {
              [PSCustomObject]@{
                  
                  AppName        = $res.DisplayName
                  Resource       = $Access.ResourceAppId
                  Permission     = $Permission.Id
                  PermissionType = $Permission.Type
              }
          }    
      }
    
  }
  
  # Filtering applications assigned &quot;delegated permissions&quot; only
  $perms = $Data | Where PermissionType -eq &quot;Scope&quot;
  
  $sps = &quot;https://graph.microsoft.com/v1.0/serviceprincipals&quot;
  $sps_res = Invoke-RestMethod -Method get -Uri $sps -ContentType &quot;application/json&quot; -Headers @{Authorization=(&quot;bearer {0}&quot; -f $accessToken)}
  
  $sp_data = ForEach($sp_res in $sps_res.value){
          ForEach($scope_ in $sp_res.oauth2PermissionScopes){
  
              [PSCustomObject]@{
                  # App_displayname = 
                  App_Id = $sp_res.appId
                  Permission_Id = $scope_.id
                  Permission_Value = $scope_.value
              }
          }  
      }
  
  ForEach($perm in $perms){
  
      $sp_data | Where-Object (App_Id -match $perm.Resource) -and (Permission_Id -match $perm.Permission)
  
  } # Export to csv here | Export-CSV $delegatedperms
  </code></pre>
  <p>My main goal is to have a csv report that resembles this one below
  <a href="https://i.stack.imgur.com/ZyXpA.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/ZyXpA.png" alt="enter image description here" /></a></p>