Why I can't call same API from Graph Explorer as Powershell executes from Az?

user_10339036 0
Viewed 79

I am connecting to Az using Powershell:

Connect-AzureAd

Then, i am trying execute command:

Get-AzRoleAssignment -ResourceGroupName 'devtest' -ResourceName 'SA-name' -ResourceType 'Microsoft.Storage/storageAccounts'

And eveything work fine, i am getting results. with -Debug flag i see, that Az executing API method:

POST https://graph.microsoft.com/v1.0/directoryObjects/microsoft.graph.getByIds

Then, i go to Graph Explorer and i try to execute the same method from there with the same account that i logged into Az and i getting an authorization error from call:

enter image description here

When i check, what kind of privilage i need to for perform this action i can see that there is no way that my account have Directory.Read.All permission granted.

So the question is, why i am allowed to do more actions from Powershell tha graph using same account?

msgraph azure-powershell microsoft-graph-api azure-active-directory powershell
1 Answers

Pls allow me post it as the answer first for a better desription.

Based on the Error tip on the top of your screenshoot, if you've consent all the permissions in that tab?

By the way, is the azure ad application you used to generate access token in powershell the same as the application for graph explorer? When I decode the access token generated by graph explorer, I found it's generated by app named Graph explorer (official site). I think it may lead to your issue.

enter image description here enter image description here

user_155812270
Related