无法通过PowerShell将Azure应用注册清单的API权限设为空数组

我要写PowerShell脚本移除Azure应用注册里的委派权限。如果还有应用类型权限，操作能成功；但要是想把所有委派权限都删掉，把requiredResourceAccess设为空数组时，用@()的脚本不管用，不过在Azure门户里操作是可以的。

原清单片段 #

"requiredResourceAccess": [
    {
        "resourceAppId": "00000000-0000-0000-0000-000000000000",
        "resourceAccess": [
            {
                "id": "00000000-0000-0000-0000-000000000000",
                "type": "Scope"
            }
        ]
    }
],

目标清单片段 #

"requiredResourceAccess": [],

测试用PowerShell脚本 #

Connect-MgGraph -Scopes "Application.ReadWrite.All" -TenantId "XXX"
$dummyPermission = @()

$appId = "XXX" # Define your App ID

$appManifest = Get-MgApplication -ApplicationId $appId
Write-Host "Original RequiredResourceAccess count: $($appManifest.RequiredResourceAccess.Count)" -ForegroundColor Yellow
Update-MgApplication -ApplicationId $appId -RequiredResourceAccess $dummyPermission
$app.RequiredResourceAccess | ConvertTo-Json -Depth 3

解决方案 #

问题出在Microsoft Graph PowerShell模块的Update-MgApplication cmdlet上，直接传空数组@()不会触发requiredResourceAccess字段的更新。得用JSON Patch的方式强制更新，具体脚本如下：

Connect-MgGraph -Scopes "Application.ReadWrite.All" -TenantId "XXX"

$appId = "XXX" # 替换为你的应用ID

# 查看初始状态
$appManifest = Get-MgApplication -ApplicationId $appId
Write-Host "Original RequiredResourceAccess count: $($appManifest.RequiredResourceAccess.Count)" -ForegroundColor Yellow

# 构建JSON Patch请求体，指定替换为空数组
$patchBody = @(
    @{
        Op = "replace"
        Path = "/requiredResourceAccess"
        Value = @()
    }
)

# 执行更新
Update-MgApplication -ApplicationId $appId -BodyParameter $patchBody

# 验证更新结果
$updatedApp = Get-MgApplication -ApplicationId $appId
$updatedApp.RequiredResourceAccess | ConvertTo-Json -Depth 3

说明 #

直接用-RequiredResourceAccess传空数组时，模块会忽略这个参数；而JSON Patch的方式会明确告诉Graph API要替换该字段的值为空数组，和Azure门户的操作逻辑一致，能确保更新生效。

内容的提问来源于stack exchange，提问作者jammyjoe