KB: Understanding Microsoft-Owned APIs, SPs, and API Permissions
1. Microsoft-Owned APIs behave differently The App Registration lives in Microsoft’s tenant (hidden from you) You only see the Service Principal (SP) in your tenant The Microsoft API SP never shows API permissions This is expected and correct Example: Power Platform API → AppID 8578e004-a5c6-46e7-913e-12f58912df43 (Microsoft-owned) 2. API permissions are ALWAYS stored on the client application , not on the Microsoft API When you grant a permission like: CopilotStudio.Copilots.Invoke It gets added to the client application's SP/App Registration , e.g.: "My Application" —not— Power Platform API SP So the client app will show: ✔ API permissions ✔ Delegated permissions ✔ Admin consent The Microsoft API SP will show: ❌ Nothing ❌ No API permissions ❌ No scopes ❌ No roles 3. Why? Because permissions are modeled as: Client App → requests → permission → from → Resource API The resource API (Microsoft-owned SP) does NOT keep track of who...