Grants/permissions do indeed need to exist on both ends, your tenant and the customer tenant.
I've since moved to doing everything with REST API, including the enterprise app consent.
Very rough example:
$ApplicationGrants = @(
[pscustomobject]@{
EnterpriseApplicationId = "00000002-0000-0000-c000-000000000000"
Scope = "Directory.Read.All,Directory.AccessAsUser.All"
} # Azure AD Graph Powershell API
[pscustomobject]@{
EnterpriseApplicationId = "00000003-0000-0000-c000-000000000000"
Scope = "Files.ReadWrite.All,Application.Read.All,Application.ReadWrite.All,AuditLog.Read.All,BitlockerKey.Read.All,Channel.Create,Channel.Delete.All,Channel.ReadBasic.All,ChannelMember.Read.All,ChannelMember.ReadWrite.All,ChannelMessage.Edit,ChannelMessage.Read.All,ChannelMessage.ReadWrite,ChannelMessage.Send,ChannelSettings.Read.All,ChannelSettings.ReadWrite.All,ConsentRequest.Read.All,Device.Command,Device.Read,Device.Read.All,DeviceManagementApps.ReadWrite.All,DeviceManagementConfiguration.ReadWrite.All,DeviceManagementManagedDevices.PrivilegedOperations.All,DeviceManagementManagedDevices.ReadWrite.All,DeviceManagementRBAC.ReadWrite.All,DeviceManagementServiceConfig.Read.All,DeviceManagementServiceConfig.ReadWrite.All,Directory.AccessAsUser.All,Directory.ReadWrite.All,Domain.Read.All,Group.ReadWrite.All,GroupMember.ReadWrite.All,Mail.Send,Mail.Send.Shared,Member.Read.Hidden,Organization.ReadWrite.All,Policy.Read.All,Policy.ReadWrite.AccessReview,Policy.ReadWrite.ApplicationConfiguration,Policy.ReadWrite.AuthenticationFlows,Policy.ReadWrite.AuthenticationMethod,Policy.ReadWrite.Authorization,Policy.ReadWrite.ConditionalAccess,Policy.ReadWrite.ConsentRequest,Policy.ReadWrite.CrossTenantAccess,Policy.ReadWrite.DeviceConfiguration,Policy.ReadWrite.ExternalIdentities,Policy.ReadWrite.FeatureRollout,Policy.ReadWrite.MobilityManagement,Policy.ReadWrite.PermissionGrant,Policy.ReadWrite.SecurityDefaults,Policy.ReadWrite.TrustFramework,PrivilegedAccess.Read.AzureResources,PrivilegedAccess.ReadWrite.AzureResources,ReportSettings.ReadWrite.All,Reports.Read.All,RoleManagement.ReadWrite.Directory,SecurityActions.ReadWrite.All,SecurityEvents.ReadWrite.All,SecurityIncident.Read.All,SecurityIncident.ReadWrite.All,ServiceHealth.Read.All,ServiceMessage.Read.All,SharePointTenantSettings.ReadWrite.All,Sites.FullControl.All,Sites.Manage.All,Sites.Read.All,Sites.ReadWrite.All,Team.Create,Team.ReadBasic.All,TeamMember.ReadWrite.All,TeamMember.ReadWriteNonOwnerRole.All,TeamSettings.Read.All,TeamSettings.ReadWrite.All,TeamsActivity.Read,TeamsActivity.Send,TeamsAppInstallation.ReadForChat,TeamsAppInstallation.ReadForTeam,TeamsAppInstallation.ReadForUser,TeamsAppInstallation.ReadWriteForChat,TeamsAppInstallation.ReadWriteForTeam,TeamsAppInstallation.ReadWriteForUser,TeamsAppInstallation.ReadWriteSelfForChat,TeamsAppInstallation.ReadWriteSelfForTeam,TeamsAppInstallation.ReadWriteSelfForUser,TeamsTab.Create,TeamsTab.Read.All,TeamsTab.ReadWrite.All,TeamsTab.ReadWriteForChat,TeamsTab.ReadWriteForTeam,TeamsTab.ReadWriteForUser,ThreatAssessment.ReadWrite.All,UnifiedGroupMember.Read.AsGuest,User.ManageIdentities.All,User.Read,User.ReadWrite.All,UserAuthenticationMethod.Read.All,UserAuthenticationMethod.ReadWrite,UserAuthenticationMethod.ReadWrite.All,Vulnerability.Read,offline_access,openid,profile"
} # Graph API
[pscustomobject]@{
EnterpriseApplicationId = "797f4846-ba00-4fd7-ba43-dac1f8f63013"
Scope = "user_impersonation"
} # Windows Azure Service Management API
[pscustomobject]@{
EnterpriseApplicationId = "00000002-0000-0ff1-ce00-000000000000"
Scope = "Exchange.Manage"
} # Exchange Online
[pscustomobject]@{
EnterpriseApplicationId = "fc780465-2017-40d4-a0c5-307022471b92"
Scope = "Vulnerability.Read"
} # Windows Defender ATP
[pscustomobject]@{
EnterpriseApplicationId = "00000003-0000-0ff1-ce00-000000000000"
Scope = "AllSites.FullControl"
} # Office 365 SharePoint Online
[pscustomobject]@{
EnterpriseApplicationId = "48ac35b8-9aa8-4d74-927d-1f4a14a0b239"
Scope = "user_impersonation"
} # Skype and Teams Tenant Admin API
)
foreach ($Grant in $ApplicationGrants) {
$AppBody = @{
ApplicationId = $SAMAppId
ApplicationGrants = @(
$Grant
)
} | ConvertTo-Json -compress
$consentRequest = Invoke-WebRequest -Method 'POST' -Uri "https://api.partnercenter.microsoft.com/v1/customers/$($tenant.TenantID)/applicationconsents" -Headers $header -Body $AppBody -UseBasicParsing
}
