Change the script to assign permission to managed identity to Msft Graph

[SuryenduB]

$ManagedIdentityName = 'LA-Emergency-Revoke-Access-OnPrem'
$GraphAppId = '00000003-0000-0000-c000-000000000000' # Don't change this. This is the immutable application ID of the Microsoft Graph service principal.
$DestinationTenantId = 'XX-XX-XX' 
$AssignMgPermissions = @(
    'User.Read.All'
    'User.ReadWrite.All' 
    'AuditLog.Read.All',
    'GroupMember.ReadWrite.All',
    'Directory.Read.All',
    'Device.ReadWrite.All',
    'DeviceManagementManagedDevices.PrivilegedOperations.All',
    'DeviceManagementManagedDevices.Read.All',
    'UserAuthenticationMethod.ReadWrite.All',
    'SynchronizationData-User.Upload' 
)

# Scopes required to perform Graph permission assignment
$MgRequiredScopes = @(
    'Application.Read.All'
    'AppRoleAssignment.ReadWrite.All'
    'Directory.Read.All'
    
)
# Connect to Graph and ExchangeOnline Powershell
Connect-MgGraph -TenantId $DestinationTenantId -Scopes $MgRequiredScopes #-NoWelcome #Uncomment NoWelcome if desired

# Get the SP objects
$MIdSPN = Get-MgServicePrincipal -Filter "displayName eq '$ManagedIdentityName'"
$GraphSPN = Get-MgServicePrincipal -Filter "appId eq '$GraphAppId'"


# Retrieve MS Graph App role Ids for your specified permissions
$AppPermIds = $GraphSPN.AppRoles | Where-Object { ($_.Value -in $AssignMgPermissions) -and ($_.AllowedMemberTypes -contains 'Application') }

# Iteravely assign the permissions to the Managed Identity
foreach ($AppPermission in $AppPermIds) {
    $AppPermissionAssingment = @{
        'PrincipalId' = $MIdSPN.Id
        'ResourceId'  = $GraphSPN.Id
        'AppRoleId'   = $AppPermission.Id
    }
  
    New-MgServicePrincipalAppRoleAssignment `
        -ServicePrincipalId $AppPermissionAssingment.PrincipalId `
        -BodyParameter $AppPermissionAssingment `
        -Verbose
}