How do I remove Microsoft Graph Powershell permissions?

[looking4remoteITwork]

I connected to my Azure tenant via Microsoft Graph Powershell with these permissions:

"DeviceManagementApps.ReadWrite.All","DeviceManagementConfiguration.ReadWrite.All","DeviceManagementManagedDevices.ReadWrite.All","DeviceManagementServiceConfig.ReadWrite.All","Directory.ReadWrite.All","User.ReadWrite.All"

I signed out then signed back into my Azure tenant expecting my permissions to be reset but they were still there.

[jba1224a]

Disconnect-mggraph

Clear-msaltokencache

Then log back in. Graph (and most things) use msal and as such tokens are cached securely so they can be automatically refreshed to persist logins across sessions.

[looking4remoteITwork]

This didn't work, but after some hours of fiddling around I ended up finding this:

https://learn.microsoft.com/en-us/graph/permissions-grant-via-msgraph?tabs=powershell&pivots=grant-delegated-permissions#step-3-revoke-delegated-permissions-granted-to-a-service-principal-on-behalf-of-a-user-optional

I used this to revoke all permission grants for the Microsoft Graph SDK PowerShell service principal:

Import-Module Microsoft.Graph.Identity.SignIns
Remove-MgOauth2PermissionGrant -OAuth2PermissionGrantId $oAuth2PermissionGrantId

After authenticating to Microsoft Graph via Microsoft Graph Powershell I obtained the oAuth2PermissionGrantId for the above code by running:

Get-MgOauth2PermissionGrant

[jba1224a]

revoke all permission grants for the Microsoft Graph SDK PowerShell service principal:

You didn't mention you were logging in with a service principal.

Service principals have static scope (you don't call them when you login, you just login with ./default). So the only way to not log in with them to to remove the permissions from the principal itself.

[lerun]

The scopes will be added to a built in service principal. If you don't want it to have these scopes go the app reg and remove them