Azure App Service(ASP.NET Core Web API)应用注册API权限配置及权限报错

我在Azure中创建了一个已配置MS Graph API权限的应用注册，本地开发时通过以下代码从用户机密中获取应用注册凭证来调用Graph API：

private GraphServiceClient GetGraphClientWithManagedIdentityOrDevClient()
{
    if (_graphServiceClient != null)
        return _graphServiceClient;

    string[] scopes = new[] { "https://graph.microsoft.com/.default" };

    var chainedTokenCredential = GetChainedTokenCredentials();
    _graphServiceClient = new GraphServiceClient(chainedTokenCredential, scopes);

    return _graphServiceClient;
}

private ChainedTokenCredential GetChainedTokenCredentials()
{
    if (_environment.IsDevelopment())
    {
        var tenantId = Environment.GetEnvironmentVariable("AZURE_TENANT_ID");
        var clientId = Environment.GetEnvironmentVariable("AZURE_CLIENT_ID");
        var clientSecret = Environment.GetEnvironmentVariable("AZURE_CLIENT_SECRET");

        var options = new TokenCredentialOptions
        {
            AuthorityHost = AzureAuthorityHosts.AzurePublicCloud
        };

        var devClientSecretCredential = new ClientSecretCredential(
            tenantId, clientId, clientSecret, options);

        var chainedTokenCredential = new ChainedTokenCredential(devClientSecretCredential);

        return chainedTokenCredential;
    }
    else
    {
        return new ChainedTokenCredential(new ManagedIdentityCredential());
    }
}

但将ASP.NET Core Web API部署到Azure App Service（已启用托管标识）后，无法像本地一样发送邮件，确定是权限问题，不清楚如何让App Service关联Azure应用注册以使用其权限发送邮件。

更新（2024年1月24日）

根据相关回复编写了以下PowerShell命令，但不确定变量赋值是否正确：

$params = @{
    principalId = "6f5ndfasfasdfasfdf228"  <—— 来自App Service托管标识页面
    resourceId = "a5cd32asdfdasdfsafasfd5db" <—— 来自应用注册的企业应用页面
    appRoleId = "6f5ndfasfasdfasfdf228" <—— 来自App Service托管标识页面
}
$servicePrincipalId = "6f5ndfasfasdfasfdf228"  <—— 来自App Service托管标识页面

New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $servicePrincipalId -BodyParameter $params

执行该命令时出现报错：New-MgServicePrincipalAppRoleAssignment_Create: 权限不足，无法完成操作。

内容的提问来源于stack exchange，提问作者Qiuzman