Bug report: Error on command 'entra app permission remove'

[tmaestrini]

Priority

(Medium) I'm annoyed but I'll live

Description

In order to update minimal permissions information for entra app permission remove in #6924, I've noticed that this error shows up when executing the command. The delegatedPermissions parameter was set, multiple permissions were assigned, connection was established via client credentials flow (appId / secret):

{"error":"Property requiredResourceAccess.resourceAccess value is required but is empty or missing."}

This makes it impossible to remove any assigned permissions – and the whole command execution fails.

Steps to reproduce

1. m365 login --appId "..." -s "..."
2. Create a demo app: m365 entra app permission add --appName "Permission Demo" --delegatedPermissions "https://management.azure.com/user_impersonation https://service.flow.microsoft.com/Flows.Read.All https://graph.microsoft.com/Agreement.Read.All" --grantAdminConsent
3. Delete the demo app: m365 entra app permission remove --appName "Permission Demo" --delegatedPermissions "https://management.azure.com/user_impersonation https://service.flow.microsoft.com/Flows.Read.All https://graph.microsoft.com/Agreement.Read.All"

Expected results

The command won't return a response on success as described on https://pnp.github.io/cli-microsoft365/cmd/entra/app/app-permission-remove

Actual results

Error: {"error":"Property requiredResourceAccess.resourceAccess value is required but is empty or missing."}

Diagnostics

// Output above intentionally omitted

Error
    at EntraAppPermissionRemoveCommand.handleRejectedODataJsonPromise (file:///Users/tobiasmaestrini/.nvm/versions/node/v20.19.5/lib/node_modules/@pnp/cli-microsoft365/dist/Command.js:286:27)
    at removeAppPermissions (file:///Users/tobiasmaestrini/.nvm/versions/node/v20.19.5/lib/node_modules/@pnp/cli-microsoft365/dist/m365/entra/commands/app/app-permission-remove.js:81:22)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async EntraAppPermissionRemoveCommand.commandAction (file:///Users/tobiasmaestrini/.nvm/versions/node/v20.19.5/lib/node_modules/@pnp/cli-microsoft365/dist/m365/entra/commands/app/app-permission-remove.js:90:17)
    at async EntraAppPermissionRemoveCommand.action (file:///Users/tobiasmaestrini/.nvm/versions/node/v20.19.5/lib/node_modules/@pnp/cli-microsoft365/dist/Command.js:208:13)
    at async Object.executeCommand (file:///Users/tobiasmaestrini/.nvm/versions/node/v20.19.5/lib/node_modules/@pnp/cli-microsoft365/dist/cli/cli.js:250:9)
    at async Object.execute (file:///Users/tobiasmaestrini/.nvm/versions/node/v20.19.5/lib/node_modules/@pnp/cli-microsoft365/dist/cli/cli.js:199:9)
    at async file:///Users/tobiasmaestrini/.nvm/versions/node/v20.19.5/lib/node_modules/@pnp/cli-microsoft365/dist/index.js:16:5
    at async file:///Users/tobiasmaestrini/.nvm/versions/node/v20.19.5/lib/node_modules/@pnp/cli-microsoft365/dist/index.js:4:1

Timings:
api: 1346.477041ms
core: 7.400666ms
command: 4513.243125ms
options: 0.056375ms
total: 4521.63475ms
validation: 0.4355ms
{"error":"Property requiredResourceAccess.resourceAccess value is required but is empty or missing."}

CLI for Microsoft 365 version

11.0.0

nodejs version

20.19.5

Operating system (environment)

macOS

Shell

zsh

cli doctor

{
  "os": {
    "platform": "darwin",
    "version": "Darwin Kernel Version 24.6.0: Mon Aug 11 21:14:08 PDT 2025; root:xnu-11417.140.69.701.11~1/RELEASE_ARM64_T8103",
    "release": "24.6.0"
  },
  "cliVersion": "11.0.0",
  "nodeVersion": "v20.19.5",
  "cliEntraAppId": "7763ce90-...",
  "cliEntraAppTenant": "single",
  "authMode": "secret",
  "cliEnvironment": "",
  "cliConfig": {
    "authType": "secret",
    "autoOpenLinksInBrowser": false,
    "copyDeviceCodeToClipboard": false,
    "output": "json",
    "printErrorsAsPlainText": false,
    "prompt": false,
    "showHelpOnFailure": false,
    "showSpinner": false,
    "errorOutput": "stdout",
    "helpMode": "full",
    "clientId": "7763ce90-...",
    "tenantId": "15016ba4-...",
    "clientSecret": "Mvp8Q~..."
  },
  "roles": [
    "Application.ReadWrite.OwnedBy",
    "Application.ReadWrite.All"
  ],
  "scopes": {}
}

Additional Info

No response

[milanholemans]

Thanks for bringing this up @tmaestrini. We'll have a look at it soon.

[milanholemans]

At first sight, it looks like the Graph endpoint to update an application doesn't work properly. Looks like it's an API issue, further investigation needed.