az ad app permission add ERROR : Property requiredResourceAccess.resourceAccess is invalid.

I have some trouble adding roles via the permission subcommand:

az ad app permission add --id $MyAppId --api $MyApplicationIWantToAccessId --api-permissions "<RoleId>=Role"

if I add my role manually via the manifest on azure, it works, if I do the same thing with this command, I get the following error:

az : ERROR: Property requiredResourceAccess.resourceAccess is invalid.
Au caractère Ligne:1 : 1
+ az ad app permission add --id xxxx --api xxxx --api-permissions "xxxx ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (ERROR: Property...ess is invalid.:String) [], RemoteException
    + FullyQualifiedErrorId : NativeCommandError

I only found examples using “Scope” instead of “Role” as permission type

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 6a5b5348-f67e-ef14-0529-4c80fddd4bc6
• Version Independent ID: bfd7e6b1-1fba-3d25-8ee3-5105bcf4157d
• Content: az ad app permission
• Content Source: src/command_modules/azure-cli-role/azure/cli/command_modules/role/_help.py
• Service: active-directory
• GitHub Login: @rloutlaw
• Microsoft Alias: routlaw

[jiasli]

@fabienso anyway, let’s stick to az rest for now. We will revisit this when we migrate to MS Graph in the future.

[fabienso]

The problem is simply that it does not recognize the “Type” -> “Role” under the permissions when the resource requirements are passed and throws the error (which is in the debug log). “Role” is not recognized or accepted when adding permissions to the Active Directory applications. Maybe I’m doing something wrong or it’s because of the current az cli version.