I have the below script which works, up until I try and assign the service principal to my app using New-MgServicePrincipalAppRoleAssignment, where it breaks down with the error: New-MgServicePrincipalAppRoleAssignment_CreateExpanded: Not a valid reference update. Create a new servicePrincipal object if it doesn't exist, or update the properties of an existing servicePrincipal object. Create a new servicePrincipal object if it doesn't exist, or update the properties of an existing servicePrincipal object. You're trying to remove a single-valued custom security attribute assignment by setting it to null using the Update-MgUser or Update-MgServicePrincipal command. The Graph API correctly rejects this PATCH request because the attribute set does not exist. The snippet above uses -BodyParameter $params. An alternative is using -CustomSecurityAttributes, i.e., Update-MgServicePrincipal -CustomSecurityAttributes $newCsa -ServicePrincipalId [.]. Learn how to assign, update, list, or remove custom security attribute assignments for users and service principals using Microsoft Graph. I'm trying to write a script to update the permissions for a managed identity using PowerShell and the REST API, but I'm running into a problem and I don't know how to troubleshoot it any further. Only the description and the maximum number of attributes can be updated. The name of the attribute set cannot be changed. This error usually means the usage field in your key credential is set to a value Microsoft Graph does not accept. Valid usage values include Sign, Verify, or VerifyEncrypted depending on the key type. Existing properties that aren't included in the request body maintains their previous values or be recalculated based on changes to other property values. For best performance you shouldn't include existing values that haven't changed.