Azure CLI SP creation w API permissions

Question

I'm attempting to construct a simple script to establish an SP with Microsoft Graph API access. I believe I need to establish an SP with the Contributor role, then assign it the API rights I want via Microsoft Graph API, and finally grant admin consent. It completes, but when I look on the portal, admin consent has not been granted, and when I try to assign manually, I receive the following:

Grant consent failed with error: Claim is invalid: 204e0828-b5ca-4ad8-b9f3-f32a958e7cc4 does not exist on resource application 00000003-0000-0000-c000-000000000000. [zPYKlPo0GJHRzGclFADr9k]

Answer 1

First, the code that was based on this query https://docs.microsoft.com/en-us/graph/permissions-reference#retrieving-permission-ids was returning the ID for AD graph, not Microsoft Graph.

Second, the admin-consent az ad app permission has been deprecated, and the az ad sp permission grant only works for Delegated permissions, not Application permissions (https://github.com/Azure/azure-cli/issues/12137#issuecomment-596567479). The solution is to get the SP's Object ID and the Microsoft Graph API's Object ID first, then utilise az rest to directly POST the grant.