How to Authenticate to Graph API from Azure Function App Using App Registration?

It sounds like you already have a good start! If you're converting your PowerShell script into a Function App, make sure you set up a Key Vault to store your app's credentials securely. You'll want to give your Function App the necessary access to read those secrets as well. Don't forget to implement System Assigned Managed Identity for your Function App—this often simplifies API connections. Also, your app registration must have the right API permissions configured to align with the operations you're handling.

Instead of managing secrets, I recommend leveraging the System Assigned Managed Identity of your Function App. This way, you can avoid dealing with the hassle of secret expiration and rotations. It should help streamline your Graph API permissions significantly. However, do note that System Managed Identity typically only supports delegated permissions. It sounds like your function aims to support PIM role activations, which indeed requires those delegated permissions to work correctly.