There is a command group 'az_ad_app_permission'. This group of commands could 'manage an application s oauth2 permissions'. The group of commands has global parameter '--debug' which means 'Increase logging verbosity to show all debug logs.'. The group of commands has global parameter '--help -h' which means 'Show this help message and exit.'. The group of commands has global parameter '--only-show-errors' which means 'Only show errors, suppressing warnings.'. The group of commands has global parameter '--output -o' which means 'Output format.'. The group of commands has global parameter '--query' which means 'JMESPath query string. See <a href="http://jmespath.org/">http://jmespath.org/</a> for more information and examples.'. The group of commands has global parameter '--subscription' which means 'Name or ID of subscription. You can configure the default subscription using `az account set -s NAME_OR_ID`.'. The group of commands has global parameter '--verbose' which means 'Increase logging verbosity. Use --debug for full debug logs.'. This group contains a child command 'az_ad_app_permission_grant'.The syntax is: az ad app permission grant --api,
                           --id,
                           --scope
                           [--consent-type {allprincipals, principal}]
                           [--principal-id]. The 1th example of the child command would be to use it to 'grant a native application with permissions to access an existing api with ttl of 2 years', the syntax is: az ad app permission grant --id e042ec79-34cd-498f-9d9f-1234234 --api a0322f79-57df-498f-9d9f-12678 --scope Directory.Read.All. The parameter '--api, --resource-id' is required. It is used to the id of the resource service principal to which access is authorized. this identifies the api which the client is authorized to attempt to call on behalf of a signed-in user.. The parameter '--id, --client-id' is required. It is used to the id of the client service principal for the application which is authorized to act on behalf of a signed-in user when accessing an api.. The parameter '--scope' is required. It is used to a space-separated list of the claim values for delegated permissions which should be included in access tokens for the resource application (the api). for example, openid user.read groupmember.read.all. each claim value should match the value field of one of the delegated permissions defined by the api, listed in the oauth2permissionscopes property of the resource service principal.. The parameter '--consent-type' is optional. indicates whether authorization is granted for the client application to impersonate all users or only a specific user. 'allprincipals' indicates authorization to impersonate all users. 'principal' indicates authorization to impersonate a specific user. consent on behalf of all users can be granted by an administrator. non-admin users may be authorized to consent on behalf of themselves in some cases, for some delegated permissions.. The parameter '--principal-id' is optional. the id of the user on behalf of whom the client is authorized to access the resource, when consenttype is 'principal'. if consenttype is 'allprincipals' this value is null. required when consenttype is 'principal'.. 