Report service principal assignments

Connect-MgGraph -NoWelcome -Scopes Directory.Read.All, Application.Read.All

param(
    [string] $TenantId = (Get-MgOrganization).Id
)
 
Connect-MgGraph -NoWelcome -Scopes Directory.Read.All, Application.Read.All
 
[array]$ServicePrincipals = Get-MgServicePrincipal -All
 
If ($ServicePrincipals) {
    # This filter finds enterprise apps where app role assignment is required. If you want to report
    # assignments for all enterprise apps, remove the clause that looks for $_.AppRoleAssignmentRequired to be True
    [array]$EnterpriseApps = $ServicePrincipals | Where-Object {$_.AppOwnerOrganizationId -ne $TenantId -and $_.AppRoleAssignmentRequired -eq $True} | `
        Sort-Object DisplayName
    Write-Host ("Analyzing assignments for {0} Enterprise Apps..." -f $EnterpriseApps.count)
    $Report = [System.Collections.Generic.List[Object]]::new()
    $CSVOutputFile = "C:\temp\ServicePrincipalAssignments.CSV"
} Else {
    Write-Host "Can't find any service principals - exiting"; break
}
[int]$i = 0
ForEach ($App in $EnterpriseApps) {
    [array]$Assignments = Get-MgServicePrincipalAppRoleAssignedTo -ServicePrincipalId $App.Id | `
            Where-Object {$_.PrincipalType -ne 'ServicePrincipal'}
    If ($Assignments) {
        $i++
        Write-Host ("Found assignments for {0}" -f $App.DisplayName)
        ForEach ($Assignment in $Assignments) {
            $ReportLine = [PSCustomObject]@{
                TimeStamp   = $Assignment.CreatedDateTime
                Id          = $Assignment.Id
                DisplayName = $Assignment.PrincipalDisplayName
                UserId      = $Assignment.PrincipalId
                Type        = $Assignment.PrincipalType
                Resource    = $Assignment.ResourceDisplayName
                ResourceId  = $Assignment.ResourceId
            }
            $Report.Add($ReportLine)
        }
    }
}
 
$Report | Select-Object Resource, DisplayName, TimeStamp, Id, ResourceId | Out-GridView
Write-Host ("Found {0} assignments - data available in {1}" -f $i, $CSVOutputFile)
$Report | Export-CSV -NoTypeInformation $CSVOutputFile