Insufficient privileges to write to schema extensions

Question

I've registered a schema extension for users.

I'd like to use it to store data about users after they login to an app, however I cant figure out the permissions. On my (admin) account I'm able to, no problem but on normal user accounts I receive:

"error": {
    "code": "Authorization_RequestDenied",
    "message": "Insufficient privileges to complete the operation.",
    "innerError": {
        "request-id": "2ee94ed5-f351-4992-8db0-2e3b420aa581",
        "date": "2017-10-04T09:37:49"
    }
}

The reason I'm using a schema extension instead of an open extensions (which does work), is that I need to be able to filter users by their extension. I cant seem to do this with an open extension.

The PATCH request is as follows:

https://graph.microsoft.com/v1.0/me

{
    "extkh2zr49b_notifications":{
        "badgeCount":"0",
        "pushToken":"test",
    }   
}

And my delegated permissions for the app are:

profile, openid, Directory.AccessAsUser.All, Directory.ReadWrite.All, User.ReadWrite.All

user_5354562 · Answer

I've concluded its impossible for normal users to edit their schema extensions. I tried granting every available permission.

I ended up using an open extension instead. I was able to return all of members of a group as well as their extensions. This was enough for me (far better than checking every user in the organisation for an extension...)

The query is below:

https://graph.microsoft.com/v1.0/groups/[id]/members/$/microsoft.graph.user?$expand=extensions&$select=id

I couldn't find this in any of Microsoft's official documentation so hopefully it continues to work!

user_105518 · Answer

Before a normal user can leverage certain scopes, you first need to provide Admin Consent for those scopes. In your case the scopes Directory.AccessAsUser.All, Directory.ReadWrite.All and User.ReadWrite.All require consent.

You might find this article helpful: v2 Endpoint and Admin Consent.

Insufficient privileges to write to schema extensions

2 Answers