CODEWITHSUNDEEP
azureactive-directoryazure-active-directory
Akhil Nair
Akhil Nair

Reputation: 3284

Create Azure AD group with Group.Create Permission

I am trying to create an Azure AD Group via the Graph API using a service principal. The intent is that the service principal will create the group in a Pipelines run.

The call I am using to attempt to create the group is

az rest --method post \
  --uri 'https://graph.microsoft.com/v1.0/groups' \
  --body '{"description": "A description", "displayName": "MyAppGroup", "mailEnabled": false, "mailNickname": "test", "securityEnabled": true, "[email protected]": ["https://graph.microsoft.com/v1.0/users/oooooooo-oooo-oooo-oooo-oooooooooooo"]}' \
  --headers "Content-Type=application/json"

To graph permissions, I have bound the API permission Group.Create to my service principal. To understand the permissions I am required to grant, I am following this page:

https://learn.microsoft.com/en-us/graph/api/group-post-groups?view=graph-rest-1.0&tabs=http#permissions

With the Group.Create permissions, when I run the rest call to the Graph API above, I get the following permission error

Forbidden({
  "error": {
    "code": "Authorization_RequestDenied",
    "message": "Insufficient privileges to complete the operation.",
    "innerError": {
      "date": "2020-11-02T13:31:35",
      "request-id": "...",
      "client-request-id": "..."
    }
  }
})

I completely understand that if I were to add the Directory.ReadWrite.All, I could make the group and would have all required permissions. However this permission is overscoped and would allow my service principal to disable users in the Active Directory tenant - something my organisation will now allow. Therefore I cannot grant my service principal this permission.

The documentation I have linked above implies to me that Group.Create is a sufficient permission to enable a service principal to create a group.

My question is what I am doing wrong, or what permissions am I missing to be able to create a group? Directory.ReadWrite.All is clearly overscoped to simply create an AD security group and so using it is not an option for me.

Upvotes: 0

Views: 874

Answers (1)

Akhil Nair
Akhil Nair

Reputation: 3284

Hopefully this helps someone else - I realised the answer immediately after posting this.

I had added the property

"[email protected]": ["https://graph.microsoft.com/v1.0/users/oooooooo-oooo-oooo-oooo-oooooooooooo"]

to the json post data.

Removing this property allowed me to create the group with just the Group.Create permission.

Adding the permission User.Read.All allows the service principal to read the user data for the owner, and so is sufficient to create the group with any necessary owners.

After adding this API permission, my service principal was able to create the group (with owners) as expected.

Upvotes: 0

Related Questions