Disables and then removes all Application permissions (AppRoles) except 'msiam_access'

[merill]

##################################################################################################
# Script: AppRole Removal                                                                        #                                                                  
# Author: Ben Wolfe                                                                              #     
# Date: 29th April 2024                                                                          #
# Version: 1.0                                                                                   #
#                                                                                                #
# Description: Disables and then removes all AppRoles except 'msiam_access'                      #
# Roles have to be disabled before they can be removed                                           #
#                                                                                                #
# Usage: Requires Object ID of the App Registration for AppID #                                  #
#                                                                                                #
# To find the AppId value use Get-MgApplication -Filter "displayName eq 'Claims X-Ray'"          #
# Important: Use the "Id" of the app and not the "AppId" returned from the above search results  #
#                                                                                                #
##################################################################################################

# Collect input parameters
$TenantName = Read-Host "Enter the Tenant Domain Name"
$AppId = Read-Host "Enter the AppId"

# Import the MgGraph module
Import-Module -Name microsoft.Graph.Applications

# Connect to Microsoft Graph
Connect-MgGraph -TenantID $TenantName -Scopes "Application.ReadWrite.All" -NoWelcome

# Get the application object using the AppId value
$app = Get-MgApplication -ApplicationId $AppId

# Get all appRoles and separate "msiam_access" and store them in separate collections
$msiamAppRole = $app.AppRoles | Where-Object { $_.displayName -eq 'msiam_access' }
$otherAppRoles = $app.AppRoles | Where-Object { $_.displayName -ne 'msiam_access' }

# Create a new collection to store all the updated appRoles including the "msiam_access" appRole
$updatedAppRoles = New-Object 'System.Collections.Generic.List[Microsoft.Graph.PowerShell.Models.MicrosoftGraphAppRole]'

# Disable all appRoles in the otherAppRoles collection and add them to the updatedAppRoles collection
foreach ($appRole in $otherAppRoles) {
        $appRole.IsEnabled = $false
        $updatedAppRoles.Add($appRole)
}

# Collect the name of the disabled app role for the success message
$removedAppRoleNames += $updatedAppRoles.displayName

# Now we need to add "msiam_access" back into the updatedAppRoles collection otherwise the update will fail if you don't reference all appRoles
$updatedAppRoles.Add($msiamAppRole)

# Update the application with the new IsEnabled state for the appRoles
Update-MgApplication -ApplicationId $app.Id -AppRoles $UpdatedAppRoles

# Now we can remove all the disabled appRoles by not referencing them in the update
Update-MgApplication -ApplicationId $app.Id -AppRoles $msiamAppRole

# Output success message
if ($removedAppRoleNames.Count -gt 0) {
    Write-Host "The following app roles were successfully removed:"
    foreach ($roleName in $removedAppRoleNames) {
        Write-Host "- $roleName"
    }
    Write-Host "Total number of roles removed: $($removedAppRoleNames.Count)"
} else {
    Write-Host "No custom app roles were removed."
}

[albert-widjaja]

@merill ,
Is there any reason why we need to keep the msiam_access AppRoles instead of deleting the whole Application registration?