CustomAuthenticationExtension.Receive.PayloadMicrosoft Graph permission · Low risk
Allows custom authentication extensions associated with the app to receive HTTP requests triggered by an authentication event. The request can include information about a user, client and resource service principals, and other information about the authentication.
Application permission
Low riskReceive custom authentication extension HTTP requests. Allows custom authentication extensions associated with the app to receive HTTP requests triggered by an authentication event. The request can include information about a user, client and resource service principals, and other information about the authentication.
| ID | 214e810f-fda8-4fd7-a475-29461495eb00 |
|---|---|
| Consent | Always needs admin consent |
| Risk | Read access, limited to what the signed-in user can see. |
Grant it to an app
In the portal: App registrations › your app › API permissions › Add a permission › Microsoft Graph › Application permissions, then grant admin consent. Or with Graph PowerShell:
Connect-MgGraph -Scopes "Application.Read.All", "AppRoleAssignment.ReadWrite.All"
$graph = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'"
$app = Get-MgServicePrincipal -Filter "appId eq '<your app's client id>'"
New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $app.Id `
-PrincipalId $app.Id -ResourceId $graph.Id -AppRoleId "214e810f-fda8-4fd7-a475-29461495eb00"Which apps already have it?
# Apps that hold CustomAuthenticationExtension.Receive.Payload as an application permission
Connect-MgGraph -Scopes "Application.Read.All"
$graph = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'"
Get-MgServicePrincipalAppRoleAssignedTo -ServicePrincipalId $graph.Id -All |
Where-Object AppRoleId -eq "214e810f-fda8-4fd7-a475-29461495eb00" |
Select-Object PrincipalDisplayName, PrincipalId, CreatedDateTime