CODEWITHSUNDEEP
azure-active-directoryazure-ad-graph-api
90abyss
90abyss

Reputation: 7357

Azure AAD and Graph API: Insufficient privileges to complete the operation

Context: I've a console app which wants to use Graph API to talk to AAD to check if a particular userId exists in the tenant or not.

I've been following the guidelines here: https://learn.microsoft.com/en-us/graph/auth-v2-service?view=graph-rest-1.0

I'm able to generate a token using this:

https://login.microsoftonline.com/common/oauth2/v2.0/token
client_id=x
&scope=https%3A%2F%2Fgraph.microsoft.com%2F.default
&client_secret=x
&grant_type=client_credentials

But when I call the graph API I get this ERROR:

https://graph.microsoft.com/v1.0/users/12345678-73a6-4952-a53a-e9916737ff7f
{
    "error": {
        "code": "Authorization_RequestDenied",
        "message": "Insufficient privileges to complete the operation.",
        "innerError": {
            "request-id": "x",
            "date": "x"
        }
    }
}

My AAD App has all the permissions from:

1. Microsoft Graph
2. Windows Azure Active Directory

I tried changing the scope to

scope=https%3A%2F%2Fgraph.microsoft.com%2Fuser.read

But this is the error I get while generating token:

The provided value for the input parameter 'scope' is not valid. The scope https://graph.microsoft.com/user.read is not valid.

I've tried combinations of "User.Read", "User.Basic.Read", etc. but nothing works.

Upvotes: 2

Views: 6579

Answers (2)

Philippe Signoret
Philippe Signoret

Reputation: 14376

The most likely reason why this is not working is because the permission which you have configured your app registration to require have not actually been granted by an administrator of your organization.

In your code, your app is authenticating as an application only. There is no signed-in user involved, and it requires your app to use and keep confidential a key used to authenticate (the client_secret parameter).

In this scenario, requesting the scope https://graph.microsoft.com/.default is the correct approach. What you're saying to Azure AD is: "please provide an access token for all the application permissions this app has been granted". Requesting the scope https://graph.microsoft.com/User.Read is not the correct approach because there is no application permission with that name.

Upvotes: 2

Jeff
Jeff

Reputation: 36593

Does the app you created have delegated permissions or application permissions to that scope?

Most likely the former. Delegated permissions don’t apply to client credentials flow.

Upvotes: 0

Related Questions