Powershell script to add users in API application in mass

To bulk assign users or groups to an Enterprise Application (API application) in Microsoft Entra (Azure AD) via PowerShell,

you can use the AzureAD or Microsoft Graph PowerShell module.

Here’s a PowerShell script using the Microsoft Graph PowerShell SDK, which is the recommended approach in 2025:

---

✅ Prerequisites:

1. Microsoft Graph PowerShell module installed:

Install-Module Microsoft.Graph -Scope CurrentUser

2. Connect to Microsoft Graph:

Connect-MgGraph -Scopes "Application.ReadWrite.All", "Directory.ReadWrite.All"

---

📄 Input CSV format (UsersToAssign.csv)

UserPrincipalName AppObjectId

neeraj@neeraj.ltd        XXXXXXXXXXXXXXX

XYZ@neeraj.ltd        XXXXXXXXXXXXXXX

---

🔁 PowerShell Script: Bulk Assign Users to API Application

# Import CSV file

$usersToAssign = Import-Csv -Path "C:\UsersToAssign.csv"

foreach ($entry in $usersToAssign) {

    $userUPN = $entry.UserPrincipalName

    $appObjectId = $entry.AppObjectId

    try {

        # Get the user object ID

        $user = Get-MgUser -UserId $userUPN

        if ($user) {

            # Assign user to Enterprise App

            New-MgServicePrincipalAppRoleAssignment `

                -ServicePrincipalId $appObjectId `

                -PrincipalId $user.Id `

                -ResourceId $appObjectId `

                -AppRoleId "00000000-0000-0000-0000-000000000000" # Default role, change if using custom roles

            Write-Host "Assigned $userUPN to app $appObjectId"

        } else {

            Write-Warning "User not found: $userUPN"

        }

    } catch {

        Write-Error "Failed to assign $userUPN to app: $_"

    }

}

---

🛠️ Notes:

AppRoleId must match the role defined in the Enterprise App (can be viewed in app manifest).

Use Get-MgServicePrincipalAppRoleAssignedTo to verify assignments.

You can also assign groups instead of individual users by replacing user lookup logic with group lookup using Get-MgGroup.

--

🔍 How to Find Correct AppRoleId

To get available roles for your Enterprise App: (Replace in script 00000000-0000-0000-0000-000000000000 with what output you get from below command)

Get-MgServicePrincipalAppRole -ServicePrincipalId <AppObjectId>

-------

The error you're seeing is because Get-MgServicePrincipalAppRole is not a valid cmdlet in the Microsoft Graph module.

To list the App Roles for a service principal (Enterprise App), use the correct command to query the AppRoles property from the service principal object.

---

✅ Correct PowerShell to List AppRoles

# Replace with your actual App (Service Principal) Object ID

$appId = "5402a3a2-9eef-4cc6-a22f-d4b736243a62"

# Fetch and display the AppRoles

(Get-MgServicePrincipal -ServicePrincipalId $appId).AppRoles

---

📌 Output Example

This will return output like:

Id DisplayName Description

-- ----------- -----------

e7bc631f-ae53-4e58-9d54-31576e19e8a4 User Regular access

c28b51b4-b7ef-42fc-81df-4e94b7f45849 Admin Full access

Use the appropriate Id value from this list in your New-MgServicePrincipalAppRoleAssignment as the AppRoleId.

If the list is empty, your app may not define any roles in its manifest. You can add roles by editing the App Registration > Manifest.

---

Once all data in place run the command and refresh Entra AD page and check.