Insufficient privileges for password reset

Question

My goal is to allow users to change and reset their own passwords within my application. We do not want users to be redirected to consent pages.

I've followed the instructions defined here:

But I'm running into the following error:

{
  "error": {
    "code": "Authorization_RequestDenied",
    "message": "Insufficient privileges to complete the operation.",
    "innerError": {
      "request-id": "19c43c69-f553-470e-9432-617395f5f8f5",
      "date": "2017-06-01T17:24:11"
    }
  }
}

My patch request:

PATCH /v1.0/users/2b6c3114-d81b-429d-af7e-c822a456ebba HTTP/1.1
Host: graph.microsoft.com
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJ...xnsYVw
Content-Type: application/json
Cache-Control: no-cache
Postman-Token: 73f...d6

{
  "passwordProfile": {
    "password": "w",
    "forceChangePasswordNextSignIn": false
  }
}

Here's my graph permissions:

Delegated permissions:

User.Read, User.ReadWrite, Directory.AccessAsUser.All*, Directory.ReadWrite.All*, User.ReadWrite.All*

Application Permissions:

Directory.ReadWriteAll*, User.Read.All*, User.ReadWrite.All*

_{* Admin Consent Required}

I understand that the scope Directory.AccessAsUser.All is required when using the passwordProfile property. Since this isn't available as an application permission, does this mean I have to get access on behalf of a user and use the Authorization Code grant? I don't see any possible way to avoid user consent when using authorization codes to retrieve a token.

EDIT 1

I've tried getting the token using the client_credentials grant_type but I always receive a message that the scope is invalid if I don't use a scope of https://graph.microsoft.com/.default:

POST /tenantid/oauth2/v2.0/token HTTP/1.1
Host: login.microsoftonline.com
Content-Type: application/x-www-form-urlencoded
Cache-Control: no-cache
Postman-Token: 006...85

client_id={id}&scope=https://graph.microsoft.com/User.Read&client_secret={secret}&grant_type=client_credentials

Insufficient privileges for password reset

2 Answers