Get-MicrosoftGraphPermissions

<#
.SYNOPSIS
    Looks up required Microsoft Graph permission scopes for a cmdlet.

.DESCRIPTION
    Wraps Find-MgGraphCommand and Find-MgGraphPermission to resolve the
    delegated and application permission scopes a given Microsoft Graph
    PowerShell cmdlet actually needs, so an app registration can be
    scoped precisely instead of guessing and granting more than
    necessary.

.PARAMETER Cmdlet
    Name of the Microsoft Graph PowerShell cmdlet to look up, for
    example Get-MgUser.

.EXAMPLE
    .\Get-MicrosoftGraphPermissions.ps1 -Cmdlet Get-MgUser

.NOTES
    Requires the Microsoft.Graph.Authentication module.

.AUTHOR
    Shehryar Hassan
#>

param(
    [Parameter(Mandatory)]
    [string]$Cmdlet
)

$command = Find-MgGraphCommand -Command $Cmdlet -ErrorAction SilentlyContinue
if (-not $command) {
    Write-Warning "No Microsoft Graph command found matching '$Cmdlet'."
    return
}

foreach ($match in $command) {
    Write-Host "$($match.Command) -> $($match.Method) $($match.URI)" -ForegroundColor Cyan
    $permissions = Find-MgGraphPermission -SearchString $match.URI -PermissionType Delegated -ErrorAction SilentlyContinue
    $permissions += Find-MgGraphPermission -SearchString $match.URI -PermissionType Application -ErrorAction SilentlyContinue

    $permissions | Select-Object -Unique Name, PermissionType, IsAdmin | Format-Table -AutoSize
}