using Pulumi;
using AzureAD = Pulumi.AzureAD;

class MyStack : Stack
{
    public MyStack()
    {
        var wellKnown = Output.Create(AzureAD.GetApplicationPublishedAppIds.InvokeAsync());
        var msgraph = new AzureAD.ServicePrincipal("msgraph", new AzureAD.ServicePrincipalArgs
        {
            ApplicationId = wellKnown.Apply(wellKnown => wellKnown.Result?.MicrosoftGraph),
            UseExisting = true,
        });
        var exampleApplication = new AzureAD.Application("exampleApplication", new AzureAD.ApplicationArgs
        {
            DisplayName = "example",
            RequiredResourceAccesses = 
            {
                new AzureAD.Inputs.ApplicationRequiredResourceAccessArgs
                {
                    ResourceAppId = wellKnown.Apply(wellKnown => wellKnown.Result?.MicrosoftGraph),
                    ResourceAccesses = 
                    {
                        new AzureAD.Inputs.ApplicationRequiredResourceAccessResourceAccessArgs
                        {
                            Id = msgraph.AppRoleIds.Apply(appRoleIds => appRoleIds.User_Read_All),
                            Type = "Role",
                        },
                        new AzureAD.Inputs.ApplicationRequiredResourceAccessResourceAccessArgs
                        {
                            Id = msgraph.Oauth2PermissionScopeIds.Apply(oauth2PermissionScopeIds => oauth2PermissionScopeIds.User_ReadWrite),
                            Type = "Scope",
                        },
                    },
                },
            },
        });
        var exampleServicePrincipal = new AzureAD.ServicePrincipal("exampleServicePrincipal", new AzureAD.ServicePrincipalArgs
        {
            ApplicationId = exampleApplication.ApplicationId,
        });
        var exampleAppRoleAssignment = new AzureAD.AppRoleAssignment("exampleAppRoleAssignment", new AzureAD.AppRoleAssignmentArgs
        {
            AppRoleId = msgraph.AppRoleIds.Apply(appRoleIds => appRoleIds.User_Read_All),
            PrincipalObjectId = exampleServicePrincipal.ObjectId,
            ResourceObjectId = msgraph.ObjectId,
        });
    }

}

package main

import (
	"github.com/pulumi/pulumi-azuread/sdk/v5/go/azuread"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		wellKnown, err := azuread.GetApplicationPublishedAppIds(ctx, nil, nil)
		if err != nil {
			return err
		}
		msgraph, err := azuread.NewServicePrincipal(ctx, "msgraph", &azuread.ServicePrincipalArgs{
			ApplicationId: pulumi.String(wellKnown.Result.MicrosoftGraph),
			UseExisting:   pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		exampleApplication, err := azuread.NewApplication(ctx, "exampleApplication", &azuread.ApplicationArgs{
			DisplayName: pulumi.String("example"),
			RequiredResourceAccesses: ApplicationRequiredResourceAccessArray{
				&ApplicationRequiredResourceAccessArgs{
					ResourceAppId: pulumi.String(wellKnown.Result.MicrosoftGraph),
					ResourceAccesses: ApplicationRequiredResourceAccessResourceAccessArray{
						&ApplicationRequiredResourceAccessResourceAccessArgs{
							Id: msgraph.AppRoleIds.ApplyT(func(appRoleIds map[string]string) (string, error) {
								return appRoleIds.User.Read.All, nil
							}).(pulumi.StringOutput),
							Type: pulumi.String("Role"),
						},
						&ApplicationRequiredResourceAccessResourceAccessArgs{
							Id: msgraph.Oauth2PermissionScopeIds.ApplyT(func(oauth2PermissionScopeIds map[string]string) (string, error) {
								return oauth2PermissionScopeIds.User.ReadWrite, nil
							}).(pulumi.StringOutput),
							Type: pulumi.String("Scope"),
						},
					},
				},
			},
		})
		if err != nil {
			return err
		}
		exampleServicePrincipal, err := azuread.NewServicePrincipal(ctx, "exampleServicePrincipal", &azuread.ServicePrincipalArgs{
			ApplicationId: exampleApplication.ApplicationId,
		})
		if err != nil {
			return err
		}
		_, err = azuread.NewAppRoleAssignment(ctx, "exampleAppRoleAssignment", &azuread.AppRoleAssignmentArgs{
			AppRoleId: msgraph.AppRoleIds.ApplyT(func(appRoleIds map[string]string) (string, error) {
				return appRoleIds.User.Read.All, nil
			}).(pulumi.StringOutput),
			PrincipalObjectId: exampleServicePrincipal.ObjectId,
			ResourceObjectId:  msgraph.ObjectId,
		})
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;

import java.util.*;
import java.io.*;
import java.nio.*;
import com.pulumi.*;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var wellKnown = Output.of(AzureadFunctions.getApplicationPublishedAppIds());

        var msgraph = new ServicePrincipal("msgraph", ServicePrincipalArgs.builder()        
            .applicationId(wellKnown.apply(getApplicationPublishedAppIdsResult -> getApplicationPublishedAppIdsResult.getResult().getMicrosoftGraph()))
            .useExisting(true)
            .build());

        var exampleApplication = new Application("exampleApplication", ApplicationArgs.builder()        
            .displayName("example")
            .requiredResourceAccesses(ApplicationRequiredResourceAccess.builder()
                .resourceAppId(wellKnown.apply(getApplicationPublishedAppIdsResult -> getApplicationPublishedAppIdsResult.getResult().getMicrosoftGraph()))
                .resourceAccesses(                
                    ApplicationRequiredResourceAccessResourceAccess.builder()
                        .id(msgraph.getAppRoleIds().apply(appRoleIds -> appRoleIds.getUser.Read.All()))
                        .type("Role")
                        .build(),
                    ApplicationRequiredResourceAccessResourceAccess.builder()
                        .id(msgraph.getOauth2PermissionScopeIds().apply(oauth2PermissionScopeIds -> oauth2PermissionScopeIds.getUser.ReadWrite()))
                        .type("Scope")
                        .build())
                .build())
            .build());

        var exampleServicePrincipal = new ServicePrincipal("exampleServicePrincipal", ServicePrincipalArgs.builder()        
            .applicationId(exampleApplication.getApplicationId())
            .build());

        var exampleAppRoleAssignment = new AppRoleAssignment("exampleAppRoleAssignment", AppRoleAssignmentArgs.builder()        
            .appRoleId(msgraph.getAppRoleIds().apply(appRoleIds -> appRoleIds.getUser.Read.All()))
            .principalObjectId(exampleServicePrincipal.getObjectId())
            .resourceObjectId(msgraph.getObjectId())
            .build());

        }
}

import pulumi
import pulumi_azuread as azuread

well_known = azuread.get_application_published_app_ids()
msgraph = azuread.ServicePrincipal("msgraph",
    application_id=well_known.result["MicrosoftGraph"],
    use_existing=True)
example_application = azuread.Application("exampleApplication",
    display_name="example",
    required_resource_accesses=[azuread.ApplicationRequiredResourceAccessArgs(
        resource_app_id=well_known.result["MicrosoftGraph"],
        resource_accesses=[
            azuread.ApplicationRequiredResourceAccessResourceAccessArgs(
                id=msgraph.app_role_ids["User.Read.All"],
                type="Role",
            ),
            azuread.ApplicationRequiredResourceAccessResourceAccessArgs(
                id=msgraph.oauth2_permission_scope_ids["User.ReadWrite"],
                type="Scope",
            ),
        ],
    )])
example_service_principal = azuread.ServicePrincipal("exampleServicePrincipal", application_id=example_application.application_id)
example_app_role_assignment = azuread.AppRoleAssignment("exampleAppRoleAssignment",
    app_role_id=msgraph.app_role_ids["User.Read.All"],
    principal_object_id=example_service_principal.object_id,
    resource_object_id=msgraph.object_id)

import * as pulumi from "@pulumi/pulumi";
import * as azuread from "@pulumi/azuread";

const wellKnown = azuread.getApplicationPublishedAppIds({});
const msgraph = new azuread.ServicePrincipal("msgraph", {
    applicationId: wellKnown.then(wellKnown => wellKnown.result?.MicrosoftGraph),
    useExisting: true,
});
const exampleApplication = new azuread.Application("exampleApplication", {
    displayName: "example",
    requiredResourceAccesses: [{
        resourceAppId: wellKnown.then(wellKnown => wellKnown.result?.MicrosoftGraph),
        resourceAccesses: [
            {
                id: msgraph.appRoleIds["User.Read.All"],
                type: "Role",
            },
            {
                id: msgraph.oauth2PermissionScopeIds["User.ReadWrite"],
                type: "Scope",
            },
        ],
    }],
});
const exampleServicePrincipal = new azuread.ServicePrincipal("exampleServicePrincipal", {applicationId: exampleApplication.applicationId});
const exampleAppRoleAssignment = new azuread.AppRoleAssignment("exampleAppRoleAssignment", {
    appRoleId: msgraph.appRoleIds["User.Read.All"],
    principalObjectId: exampleServicePrincipal.objectId,
    resourceObjectId: msgraph.objectId,
});

resources:
  msgraph:
    type: azuread:ServicePrincipal
    properties:
      applicationId: ${wellKnown.result.MicrosoftGraph}
      useExisting: true
  exampleApplication:
    type: azuread:Application
    properties:
      displayName: example
      requiredResourceAccesses:
        - resourceAppId: ${wellKnown.result.MicrosoftGraph}
          resourceAccesses:
            - id: ${msgraph.appRoleIds"User.Read.All"[%!s(MISSING)]}
              type: Role
            - id: ${msgraph.oauth2PermissionScopeIds"User.ReadWrite"[%!s(MISSING)]}
              type: Scope
  exampleServicePrincipal:
    type: azuread:ServicePrincipal
    properties:
      applicationId: ${exampleApplication.applicationId}
  exampleAppRoleAssignment:
    type: azuread:AppRoleAssignment
    properties:
      appRoleId: ${msgraph.appRoleIds"User.Read.All"[%!s(MISSING)]}
      principalObjectId: ${exampleServicePrincipal.objectId}
      resourceObjectId: ${msgraph.objectId}
variables:
  wellKnown:
    Fn::Invoke:
      Function: azuread:getApplicationPublishedAppIds
      Arguments: {}