CODEWITHSUNDEEP
azureazure-active-directory
Don
Don

Reputation: 43

Permissions required to run Remove-AzureRMAdGroup

I'm using an SPN to remove an Azure AD group (Remove-AzureRMAdGroup), but get the error insufficient privileges.

I granted the SPN the following permissions:

Active Directory Graph (2) - Application Read and write all applications - Application Read and write directory data

Microsoft Graph (1) - Application Read and write groups

What permissions are apparently missing here? If we assign the SPN the Azure AD role UserAccountAdmin it works, but we'd prefer to have least privileged access.

Upvotes: 4

Views: 9645

Answers (1)

Tony Ju
Tony Ju

Reputation: 15619

Currently, the Read and write directory data permission does not include the ability to do any deletions such as deleting groups. What you need is microsoft.directory/groups/delete permission.

enter image description here

But there is no support today for custom roles in Azure Active Directory. Only the predefined Administrator Roles. You have to grant the SPN the Azure AD role User administrator role which include group deletion permission.

Here are the steps.

Upvotes: 3

Related Questions