Graph API - Insufficient privileges to complete the operation

user_6003568 0
Viewed 91524

When trying to access the Graph Service Client using I am receiving the error :

Code: Authorization_RequestDenied
Message: Insufficient privileges to complete the operation.

After researching this error the most common solution was to set the permissions for the API. This had already been done and has permissions to read basic/full profiles.

I've delete and re-added the APIs.

Below is the code in my AzureAuthenticationProvider class which inherits from IAuthenticationProvider: 

public class AzureAuthenticationProvider : IAuthenticationProvider
{
    private string _azureDomain = "myDevDom.onmicrosoft.com";

    public async Task AuthenticateRequestAsync(HttpRequestMessage request)
    {
        try
        {
            string clientId = "2b823c67-1b0d-4a10-a9e1-737142516f5q";
            string clientSecret = "xxxxxx";

            AuthenticationContext authContext = new AuthenticationContext("https://login.windows.net/" + _azureDomain + "/oauth2/token");

            ClientCredential credentials = new ClientCredential(clientId, clientSecret);

            AuthenticationResult authResult = await authContext.AcquireTokenAsync("https://graph.microsoft.com/", credentials);

            request.Headers.Add("Authorization", "Bearer " + authResult.AccessToken);
        }
        catch (Exception ex)
        {
        }
    }
}

I've tried changing the client secret to an invalid Id and it threw an error, so the client key is correct. I've also tried to verify that the access token is valid by altering the access token, this also returns a error.

The above code seems to work fine.

Below is the code where I'm trying to access Azure AD:

public async Task<IGraphServiceUsersCollectionPage> GetUsersByLastName(string lastname)  
{
    GraphServiceClient graphClient = new GraphServiceClient(new AzureAuthenticationProvider());
    string filter = String.Format("startswith(surname, '{0}')", lastname);
    IGraphServiceUsersCollectionPage users = await graphClient.Users.Request().Filter(filter).GetAsync(); //Fails on this line
    return users;
}

Any help is much appreciated, and thanks in advance for any help. azureADpermissionProperties

azure-ad-graph-api azure-active-directory azure permissions c#
12 Answers

Grant permission Make sure click "Grant Permissions" and than Yes for all users accounts.

user_11663050

In my case, delete user was not working. I took below steps & it started working for me.

Go to Azure Active Directory > Roles and administrators > Click on 'User administrator' > click on '+ Add assignment' to add your app. (i.e. console app using AAD Graph REST API to interact with Azure Active Directory).

Hope it helps someone.

user_8806000

Grant permissions by ticking 'Directory.Read.All/ Write' is not enough.

I run into the same issue. and solved by adding service principle to administrator role.

If you application is created recently, this can be done Azure AD Powershell. 

$pricinple = Get-AzureADServicePrincipal || Where-Object {$_.DisplayName -eq 'youappname'}

 $role = Get-AzureADDirectoryRole | Where-Object {$_.displayName -eq 'Company Administrator'}

Add-AzureADDirectoryRoleMember -ObjectId $role.ObjectId -RefObjectId $pricinple.ObjectId

for detail, see https://docs.microsoft.com/en-us/powershell/module/Azuread/Add-AzureADDirectoryRoleMember?view=azureadps-2.0

If you application was created long time ago, you will need to use MSOnline. see: https://docs.microsoft.com/en-us/powershell/module/msonline/Add-MsolRoleMember?view=azureadps-1.0

user_27528920
user_70010670

I had to add all "groups" (ID, Access, SAML) into the token. This can be configurated in the Azure Active Directory Token Configuration and checked via https://jwt.io/.

user_84358890

you should give Directory.Read role to the service principal in the AD page, not the app register page. enter image description here

enter image description here

by the way. I am use python sdk azure-graphrbac with serviceprincipal from msrestazure.azure_active_directory import ServicePrincipalCredentials

    credential = ServicePrincipalCredentials(ServicePrincipal_APP_ID,ServicePrincipal_SECRET_VALUE,tenant=ServicePrincipal_TENANT_ID,resource="https://graph.windows.net/")
    self.client=GraphRbacManagementClient(credential,TENANT_ID,base_url)
user_76828800

Go to Azure Portal -> Active Directory -> App registrations -> Select Your Application -> API permissions

Now, Click on Add a permission and choose Microsoft Graph, select Application Permission and search for User.Read.All

Add these permissions to your application and it should work.

user_38442770
Related