title: Create OAuth2PermissionGrant for Resources via Graph
body: <p>My scenario is to create app &amp; spn via AAD Graph. That ist rather easy (with a redirect for browser-based consent), what I now want to do is consent the spn right away (like you can do in the portal). The code itself is straight-forward:</p>
  
  <pre><code>var g = new OAuth2PermissionGrant();
  g.ClientId = thePrincipal.ObjectId;
  g.ConsentType = "AllPrincipals";
  g.PrincipalId = null;
  g.ResourceId = ##resourceId##;
  g.ExpiryTime = DateTime.Now.AddYears(10);
  g.Scope = "User.Read";
  await client.Oauth2PermissionGrants.AddOAuth2PermissionGrantAsync(g);
  </code></pre>
  
  <p>Now the part that I haven't figured out properly is <code>##resourceId##</code>. This is supposed to be the <code>resourceId</code> - in the code sample, it should be Windows Azure Active Directory. How do I get the resourceId for eg the following required resource access (<code>00000002-0000-0000-c000-000000000000</code>):</p>
  
  <pre><code>RequiredResourceAccess =
      new [] {
          new RequiredResourceAccess() {
                  ResourceAppId = "00000002-0000-0000-c000-000000000000",
                      ResourceAccess = new [] {
                          new ResourceAccess() {
                              Id = new Guid("311a71cc-e848-46a1-bdf8-97ff7156d8e6"), // sign in and read profile (delegated perm)
                                  Type = "Scope"
                          },
  </code></pre>
  
  <p>The lookup <code>ResourceAppId</code> -> <code>resourceId</code> (app to spn) is what I am missing. For eg AAD, Graph, manage.office.com et al.</p>