Granting Azure Resources Access to SharePoint Online Sites Using Managed Identity

Yes, This script will assign the permission if provided with the managed identity object id

# Add sites.Selected permssion to managed identity

# Define the Managed Identity client ID (App ID)
$managedIdentityAppId = "<Managed Identity Object Id>"

# Get the Microsoft Graph service principal
$graphSp = Get-MgServicePrincipal -Filter "displayName eq 'Microsoft Graph'"

# Find the app role ID for 'Sites.FullControl.All'
$sitesControlRole = $graphSp.AppRoles | Where-Object {
    $_.Value -eq "Sites.Selected" -and $_.AllowedMemberTypes -contains "Application"
}

if (-not $sitesControlRole) {
    Write-Error "Sites.Selected role not found in Microsoft Graph."
    exit
}

# Get the Managed Identity's service principal
$miSp = Get-MgServicePrincipal -Filter "id eq '$managedIdentityAppId'"

if (-not $miSp) {
    Write-Error "Managed Identity with AppId '$managedIdentityAppId' not found."
    exit
}

# Check if the permission already exists
$existingAssignment = Get-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $miSp.Id |
    Where-Object { $_.AppRoleId -eq $sitesControlRole.Id -and $_.ResourceId -eq $graphSp.Id }

if ($existingAssignment) {
    Write-Host "'Sites.Selected' is already assigned to the Managed Identity."
} else {
    # Create the app role assignment
    New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $miSp.Id -BodyParameter @{
        PrincipalId = $miSp.Id
        ResourceId  = $graphSp.Id
        AppRoleId   = $sitesControlRole.Id
    }

    Write-Host "Successfully assigned 'Sites.Selected' permission to the Managed Identity."