Create Entra app reg, with a service principal and admin consent using bicep

entra-app-reg.bicep

extension microsoftGraph

resource appRegistration 'Microsoft.Graph/[email protected]' = {
  displayName: 'My Graph connector'
  uniqueName: 'my-graph-connector'
  signInAudience: 'AzureADMyOrg'
  requiredResourceAccess: [
    {
      resourceAppId: '00000003-0000-0000-c000-000000000000'
      resourceAccess: [
        {
	  id: 'f431331c-49a6-499f-be1c-62af19c34a9d'
	  type: 'Role'
        }
	{
	  id: '8116ae0f-55c2-452d-9944-d18420f5b2c8'
	  type: 'Role'
	}
      ]
    }
  ]
}

resource sp 'Microsoft.Graph/[email protected]' = {
  appId: appRegistration.appId
}

resource graphSp 'Microsoft.Graph/[email protected]' existing = {
  appId: '00000003-0000-0000-c000-000000000000'
}

resource externalConnectionReadWriteOwnedByAssignment 'Microsoft.Graph/[email protected]' = {
  principalId: sp.id
  resourceId: graphSp.id
  appRoleId: 'f431331c-49a6-499f-be1c-62af19c34a9d'
}

resource externalItemReadWriteOwnedByAssignment 'Microsoft.Graph/[email protected]' = {
  principalId: sp.id
  resourceId: graphSp.id
  appRoleId: '8116ae0f-55c2-452d-9944-d18420f5b2c8'
}

output appId string = appRegistration.appId
output spId string = sp.id