Fix incorrect Microsoft Graph permission GUIDs in Entra app registration script

[Paul Lizer (paullizer)]

Summary

The delegated Microsoft Graph permission GUIDs in Initialize-EntraApplication.ps1 were shifted by one entry, so the script configured permissions that did not match the names it logged.

Script label	GUID used	Actually is
People.Read.All	b340eb25-...	User.ReadBasic.All
User.ReadBasic.All	b4e74841-...	User.ReadWrite

Impact

• People.Read.All was never requested or granted, despite the script logging SUCCESS: Added: People.Read.All.
• User.ReadWrite was granted instead - a write scope the application never uses.

SCOPE in application/single_app/config.py requires only User.Read, User.ReadBasic.All, People.Read.All, and Group.Read.All. User.ReadWrite appears nowhere under application/.

Because the script logs the intended names rather than the resolved GUIDs, the mismatch was silent.

Fix

Corrected both GUIDs. All eight entries were then verified against the live Microsoft Graph service principal oauth2PermissionScopes:

User.Read            OK
profile              OK
email                OK
Group.Read.All       OK
offline_access       OK
openid               OK
People.Read.All      OK
User.ReadBasic.All   OK

Validation

• Script parses cleanly (System.Management.Automation.Language.Parser).
• Applied to four existing app registrations: People.Read.All added, User.ReadWrite removed, admin consent re-granted. Resulting granted scopes now match config.py exactly.

Note for existing deployments

Registrations created by the previous version of this script have User.ReadWrite granted and are missing People.Read.All. They need correcting - the fix here only affects newly created registrations.

deployers/version.txt bumped to 1.0.29.