Permissions Ids for Graph

Set-AzAPIPermission.ps1

Get Permissions

# MS Graph Permissions
(Get-AzAdServicePrincipal -ApplicationId 00000003-0000-0000-c000-000000000000).AppRole | Select *
(Get-AzAdServicePrincipal -ApplicationId 00000003-0000-0000-c000-000000000000).Oauth2PermissionScope | Select *

# Azure AD Graph
(Get-AzAdServicePrincipal -ApplicationId 00000002-0000-0000-c000-000000000000).AppRole | Select *
(Get-AzAdServicePrincipal -ApplicationId 00000002-0000-0000-c000-000000000000).Oauth2PermissionScope | Select *

# https://docs.microsoft.com/en-us/powershell/module/az.resources/add-azadapppermission?view=azps-8.1.0

# Get "Group.Read.All" from Azure AD Graph
$ADPermission = (Get-AzAdServicePrincipal -ApplicationId 00000003-0000-0000-c000-000000000000).AppRole | ? {$_.value -like "Group.Read.All"}

# Get Application to set permissions
$AzApp = Get-AzADApplication -DisplayName MyApp

# Add API Permissions to Application
Add-AzADAppPermission -PermissionId $ADPermission.id -ApplicationId $AzApp.AppId -ApiId 00000003-0000-0000-c000-000000000000 -Type Role

# Consent has to be done via GUI though