Add Graph API permissions to managed identity

msiGraphApiPermissions.ps1

$tenantId = "00000000-0000-0000-0000-000000000000" # Replace with your tenant ID
$graphApiAppId = "00000003-0000-0000-c000-000000000000" # Well known ID
$msiName = "MSINAME" # Name of your managed identity e.g. name of Function or Logic App
$graphPermissions = @("Directory.Read.All", "User.Read.All") # Add or remove permissions

Connect-AzureAD -TenantId $tenantId
$msi = Get-AzureADServicePrincipal -Filter "displayName eq '$msiName'" # Can take a few seconds, add a sleep if necessary
$graphApiAppRegistration = Get-AzureADServicePrincipal -Filter "appId eq '$graphApiAppId'"
$appRoles = $graphApiAppRegistration.AppRoles | Where-Object { $graphPermissions -contains $_.Value -and $_.AllowedMemberTypes -contains "Application" }
foreach ($appRole in $appRoles) {
  New-AzureAdServiceAppRoleAssignment -ObjectId $msi.ObjectId -PrincipalId $msi.ObjectId -ResourceId $graphApiAppRegistration.ObjectId -Id $appRole.Id
}

If you want to assign for example Exchange Online permissions, you can adjust line 8:

$graphApiAppRegistration = Get-AzureADServicePrincipal -Filter "displayName eq 'Office 365 Exchange Online'" 

And then use permissions like Exchange.ManageAsApp