Authorization_RequestDenied - Access to change password operation is denied.

Question

Hi,

I am writing an API for user to reset self password. User is logged in an web application which calls MS Graph API.

While trying to self update password(I need to verify the current password too), I am getting below error:

code":"Authorization_RequestDenied","message":"Access to change password operation is denied."

Below is my code:

 private static async Task UpdatePassword(string clientId, string clientSecret, string tenantId)  
    {  
        try  
        {   
            var scopes = new string[] { "https://graph.microsoft.com/.default" };  
  
            // Configure the MSAL client as a confidential client  
            var confidentialClient = ConfidentialClientApplicationBuilder  
                .Create(clientId)  
                .WithAuthority($"https://login.microsoftonline.com/{tenantId}/v2.0")  
                .WithClientSecret(clientSecret)  
                .Build();  
  
             
            GraphServiceClient graphServiceClient =  
                new GraphServiceClient(new DelegateAuthenticationProvider(async (requestMessage) =>  
                {  
  
                // Retrieve an access token for Microsoft Graph (gets a fresh token if needed).  
                    var authResult = await confidentialClient  
                .AcquireTokenForClient(scopes)  
                .ExecuteAsync();  
  
                // Add the access token in the Authorization header of the API request.  
                    requestMessage.Headers.Authorization =  
                new AuthenticationHeaderValue("Bearer", authResult.AccessToken);  
                })  
                );   
  
            await graphServiceClient.Users["9c704dfb-a3ea-528a-937c-d7da45ebcc7a"]  
                .ChangePassword("OldPassword", "NewPassword").Request().PostAsync();   
  
        }catch(Exception e)  
        {   
        }  
    }

I also saw /me endpoints but did not understand how to make that work in my scenario.

I appreciate any help, Thank you.

Answer

Hi @Sachin ,

Please note, the operation cannot be performed on a user's own account. Only an administrator with the appropriate permissions can perform this operation.

Please refer to this post for additional information.

Hope this helps,
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Answer

Hi @Sachin

Your code is trying to update another user's password and not the user's own password, you should call the /me endpoint to reset the self password for the user. Please refer to my complete code:

using Azure.Identity;  
using Microsoft.Graph;  
  
var scopes = new[] { "Directory.AccessAsUser.All" };  
var tenantId = "{tenant id}";  
var clientId = "{client id}";  
var clientSecret = "{client secret}";  
  
// For authorization code flow, the user signs into the Microsoft  
// identity platform, and the browser is redirected back to your app  
// with an authorization code in the query parameters  
var authorizationCode = "authorization code";  
  
// using Azure.Identity;  
var options = new TokenCredentialOptions  
{  
    AuthorityHost = AzureAuthorityHosts.AzurePublicCloud  
};  
  
// https://learn.microsoft.com/dotnet/api/azure.identity.authorizationcodecredential  
var authCodeCredential = new AuthorizationCodeCredential(  
    tenantId, clientId, clientSecret, authorizationCode, options);  
  
var graphClient = new GraphServiceClient(authCodeCredential, scopes);  
  
var currentPassword = "OldPassword";  
  
var newPassword = "NewPassword";  
  
await graphClient.Me  
    .ChangePassword(currentPassword, newPassword)  
    .Request()  
    .PostAsync();

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Authorization_RequestDenied - Access to change password operation is denied.

2 answers