M365 PowerShell

Using Remove-MgApplicationOwnerByRef in Graph PowerShell

The Remove-MgApplicationOwnerByRef cmdlet in Microsoft Graph PowerShell is essential for managing application ownership in your Microsoft 365 environment. This cmdlet allows you to remove one or more owners from an application, ensuring that the right people have the necessary access. In this article, we'll explore the syntax, usage examples, cmdlet tips, potential errors, and solutions to help you effectively use Remove-MgApplicationOwnerByRef.

Note: You need owner id to work with this cmdlet. Use Get-MgApplicationOwner to get the IDs.

Cmdlet Syntax

Remove-MgApplicationOwnerByRef -ApplicationId <String> -DirectoryObjectId <String> [-Confirm]

-ApplicationId: The unique identifier (GUID) of the application from which you want to remove an owner.
-DirectoryObjectId: The unique identifier (GUID) of the user (owner) to be removed. This ID corresponds to the user’s UserId.
-Confirm: Prompts for confirmation before executing the removal.

Usage Examples

Example 1: Single Owner Removal

To remove a single owner from an application, use the following command:

$applicationId = "12345678-abcd-1234-abcd-1234567890ab"
$ownerId = "87654321-dcba-4321-dcba-0987654321ba"

Remove-MgApplicationOwnerByRef -ApplicationId $applicationId -DirectoryObjectId $ownerId

This command removes the specified owner from the application.

Example 2: Bulk Owner Removal

If you need to remove multiple owners, you can loop through a list of owner IDs:

$applicationId = "12345678-abcd-1234-abcd-1234567890ab"
$ownerIds = @("87654321-dcba-4321-dcba-0987654321ba", "23456789-abcd-1234-abcd-1234567890cd")

foreach ($ownerId in $ownerIds) {
    Remove-MgApplicationOwnerByRef -ApplicationId $applicationId -DirectoryObjectId $ownerId
}

This script loops through the array of owner IDs and removes each one from the specified application.

Example 3: Removal with Confirmation Prompt

You can use the -Confirm parameter to prompt for confirmation before removing the owner:

$applicationId = "12345678-abcd-1234-abcd-1234567890ab"
$ownerId = "87654321-dcba-4321-dcba-0987654321ba"

Remove-MgApplicationOwnerByRef -ApplicationId $applicationId -DirectoryObjectId $ownerId -Confirm

This command will prompt you to confirm the removal action before proceeding.

Cmdlet Tips

Understanding Parameters: Ensure you correctly identify the ApplicationId and DirectoryObjectId (which corresponds to the UserId of the owner).
Use Loops for Bulk Operations: When dealing with multiple owners, a loop can help you automate the process.
Confirmation Prompt: Use the -Confirm parameter when you want to ensure that removals are intentional, especially in production environments.

Possible Errors & Solutions

Error: ResourceNotFound

Cause: The ApplicationId or DirectoryObjectId does not exist.

Solution: Double-check that the IDs are correct. You can retrieve the application and owner details using Get-MgApplication and Get-MgUser cmdlets.

Error: Request_BadRequest

Cause: Invalid parameter values or missing required parameters.

Solution: Ensure that both -ApplicationId and -DirectoryObjectId are provided with valid GUIDs.

Error: Request_UnsupportedQuery

Cause: An unsupported query or filter was used in the cmdlet.

Solution: The Remove-MgApplicationOwnerByRef cmdlet does not support filters. Ensure you use the correct parameters and avoid unsupported queries.

Error: InsufficientPrivileges

Cause: The user running the command does not have sufficient permissions.

Solution: Ensure that the user has the necessary admin roles to manage application ownership.

Use Cases

Revoking Access: When an individual should no longer have ownership rights to an application, use this cmdlet to revoke their access.
Automated Ownership Management: In large organizations, automate the process of removing owners who no longer require access to streamline application management.

Conclusion

The Remove-MgApplicationOwnerByRef cmdlet is a powerful tool for managing application ownership within Microsoft 365. By understanding its syntax, usage scenarios, and potential pitfalls, you can ensure that only the appropriate individuals have access to manage your applications. Whether you’re removing a single owner or handling bulk removals, this cmdlet helps maintain the security and integrity of your Microsoft 365 environment.

Additional Resources:

Graph PowerShell Remove-MgApplicationOwnerByRef Cmdlet Documentation
Microsoft Graph PowerShell Module Documentation
Microsoft Graph API Documentation

Using Get-MgDirectoryRole in Graph PowerShell
Using Get-MgUserLicenseDetail in Graph PowerShell
Using Find-GraphMgCommand in Graph PowerShell
Connect to Microsoft 365 Using PowerShell
How to Create Bulk Users in Office 365 Using Graph PowerShell?
Create Microsoft 365 Group Using Microsoft Graph PowerShell
Block Microsoft 365 User Using Microsoft Graph PowerShell
Assign Microsoft 365 License Using Graph PowerShell
Microsoft 365 User Management Using Graph PowerShell
Checking Group Membership in Microsoft 365
Bulk Assign Microsoft 365 License
Find Inactive Users in Microsoft 365
Using Powershell Graph Search Query
Using Powershell Graph Filter Query
Using Where-Object In Graph PowerShell
Using Expand Property In Graph PowerShell
Using Select Object In Graph PowerShell
Using -Contains Operator In Graph PowerShell
Add User to Multiple Microsoft 365 Groups Using Graph PowerShell
Get Microsoft 365 User Location Using Graph PowerShell
Import Microsoft 365 Groups from CSV File Using Graph PowerShell
Microsoft 365 Group User Import Using Graph PowerShell