NotFound error when revoking permissions granted for Teams Enterprise application

Question

I am working with a Teams app enterprise application. We are testing some permission related changes and require a fresh app load that does not have any permissions granted by the user or admin.

To revoke the user permissions inside Azure Portal: Enterprise Applications, selecting my app, then the "Permissions" tab/blade, click the "Review Permissions" button, select radio button "This application has more permissions than I want", copy the Powershell script (all of it, some of it is cropped out in the small input box), running the script gives the following error on the second line:

$sp = Get-AzureADServicePrincipal -ObjectId "17a19fcd-xxxx-yyyy-zzzz-7b1411390c01

Get-AzureADServicePrincipal : Error occurred while executing GetServicePrincipal
Code: Request_ResourceNotFound
Message: Resource '17a19fcd-xxxx-yyyy-zzzz-7b1411390c01' does not exist or one of its queried reference-property objects are not present.
RequestId: bfdcfd56-xxxx-yyyy-zzzz-fb16d4c796ef
DateTimeStamp: Wed, 06 Apr 2022 09:17:09 GMT
HttpStatusCode: NotFound
HttpStatusDescription: Not Found
HttpResponseStatus: Completed
At line:1 char:1
+ Get-AzureADServicePrincipal -ObjectId "17a19fcd-xxxx-yyyy-zzzz-7b1411390c01 ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : NotSpecified: (:) [Get-AzureADServicePrincipal], ApiException
+ FullyQualifiedErrorId : Microsoft.Open.AzureAD16.Client.ApiException,Microsoft.Open.AzureAD16.PowerShell.GetServicePrincipal 

Answer 1

The reason for this was that I already ran the sript once before, on the second run, the ObjectId has changed, but Azure Portal doesn't tell you the correct one and just shows the old script with the old ObjectId.

To fix the script, get the new ObjectId:

1. Run Get-AzureADServicePrincipal -All $true
2. Copy out the output and search for your app, if the output is being cut out then increase the Screen buffer size in the PowerShell/CMD Properties.
3. Now use this new ObjectId in the second line: $sp = Get-AzureADServicePrincipal -ObjectId "NEW_ID-HERE-yyyy-zzzz-123abc123abc