Mail.send permission, Microsoft Graph and application arent playing nicely

Question

Mail.send permission, Microsoft Graph and application arent playing nicely

Greg Smith 0

Issue Summary: Our App Service BlockADE has a system‑assigned managed identity that shows as enabled in the portal with Object ID 14be8524‑8822‑428a‑bddc‑3d35f6bfbfb4, but the corresponding service principal was never created in Microsoft Entra ID. As a result, the identity cannot be found under Enterprise Applications, and we cannot assign Microsoft Graph application permissions (Mail.Send). This appears identical to a previous issue where the backend identity host VM had to be corrected (changed from 0 to 1).

Details:

App Service name: BlockADE

Directory: Gibson Technical Services (gts‑yes.com)

Subscription: GTS Safety Azure

Managed identity status: On

Managed identity Object ID: 14be8524‑8822‑428a‑bddc‑3d35f6bfbfb4

The identity does not appear in Enterprise Applications

The App Service’s SSO application appears instead, which cannot accept Graph permissions

“Application permissions” is greyed out

No API permissions can be added

This is blocking us from assigning Microsoft Graph → Application permissions → Mail.Send

Request: Please re‑provision the system‑assigned managed identity for the App Service BlockADE. Specifically, we need the backend identity host to be repaired and the service principal to be force‑created in Entra ID so that the identity appears in Enterprise Applications and can receive Microsoft Graph application permissions.

This is the same fix that was applied previously when the VM count was corrected from 0 to 1.

Greg Smith 0 Reputation points

2026-01-30T21:00:30.6133333+00:00

ive tried that
VEMULA SRISAI 13,980 Reputation points Microsoft External Staff Moderator

2026-01-30T21:27:34.28+00:00
Hello Greg Smith

Thanks for the detailed information. Based on your description, the issue is that the system‑assigned managed identity (SA‑MI) for your App Service shows an Object ID, but the corresponding service principal was never created in Microsoft Entra ID. This results in the identity not appearing under Enterprise Applications, and therefore you are unable to assign Microsoft Graph → Application permissions → Mail.Send.

You can attempt the following remediation steps:

Re‑provision the system‑assigned managed identity

Try turning the identity Off → Save → On → Save from the App Service Identity blade.

If that doesn't recreate the service principal, reassign the identity via CLI

Shell

az webapp identity remove -g <resourceGroup> -n <appName>

az webapp identity assign -g <resourceGroup> -n <appName>

Please let me know once you’ve tried the re‑provisioning steps,
VEMULA SRISAI 13,980 Reputation points Microsoft External Staff Moderator

2026-02-03T19:01:36.97+00:00

Greg Smith Just checking in to see if you were able to try the re‑provisioning steps for the system‑assigned managed identity:

Your answer

Greg Smith 0 Reputation points

2026-01-30T21:00:30.6133333+00:00

ive tried that
VEMULA SRISAI 13,980 Reputation points Microsoft External Staff Moderator

2026-01-30T21:27:34.28+00:00

Hello Greg Smith

Thanks for the detailed information. Based on your description, the issue is that the system‑assigned managed identity (SA‑MI) for your App Service shows an Object ID, but the corresponding service principal was never created in Microsoft Entra ID. This results in the identity not appearing under Enterprise Applications, and therefore you are unable to assign Microsoft Graph → Application permissions → Mail.Send.

You can attempt the following remediation steps:

Re‑provision the system‑assigned managed identity

Try turning the identity Off → Save → On → Save from the App Service Identity blade.

If that doesn't recreate the service principal, reassign the identity via CLI

Shell

az webapp identity remove -g <resourceGroup> -n <appName>

az webapp identity assign -g <resourceGroup> -n <appName>

Please let me know once you’ve tried the re‑provisioning steps,
VEMULA SRISAI 13,980 Reputation points Microsoft External Staff Moderator

2026-02-03T19:01:36.97+00:00

Greg Smith Just checking in to see if you were able to try the re‑provisioning steps for the system‑assigned managed identity: