"Insufficient privileges to complete the operation" while using Graph API

Question

The access token I get from the following curl request
curl "$IDENTITY_ENDPOINT?resource=https://graph.microsoft.com&api-version=2017-09-01" -H secret:$IDENTITY_HEADER
does not have the permission to list or create user.

Request:
GET /v1.0/users HTTP/1.1
Host: graph.microsoft.com
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJub......

Response
{
"error": {
"code": "Authorization_RequestDenied",
"message": "Insufficient privileges to complete the operation.",
"innerError": {
"date": "2020-12-14T17:27:10",
"request-id": "c172e8b7-ccf5-4ace-8c76-609d826787ce",
"client-request-id": "c172e8b7-ccf5-4ace-8c76-609d826787ce"
}
}
}

Curl request I made was from App service. I have enabled managed identity, and also added it as contributor in access control from subscription.
What am I doing wrong?

My goal is to get an access token from an App-Service as shown above and use it to create a user in azure ad.
If there is any alternative way it will be good.

Answer 1

I have gone through the various queries related to this topic, and may be mine is a duplicate.

But I am kind of stuck with this now, kindly advice the solution to this.

I have been using the Application authorisation to get users [https://graph.microsoft.com/v1.0/me] via graph API in postman.
For this I have followed the comments and decoded the access token from https://jwt.ms

I am seeing roles as in attached image in the decoded token:

Kindly suggest, what needs to be done to fix this.

Answer 2

In the beginning thanks for previous posts it gave a lot of inspiration according topic. Problem occurred in our case at automated bicep mechanism that is supposed to add API permissions for Microsoft Graph.

Error: Authorization_RequestDenied

Solution:

We needed to give Enterprise Application running mechanism Microsoft Graph (not Azure Active Directory Graph it will be deprecated) Application permissions:

• Application.ReadWrite.All
• AppRoleAssignment.ReadWrite.All
• Directory.ReadWrite.All

Answer 3

I'm getting this dreaded error too when calling Get-AzADGroup. What microsoft.graph permission is necessary? I am so frustrated.
I have had Application.Read.All, Directory.Read.All. What am I missing?

Answer 4

Hi Please add,

UserAuthendicationMethod.Read.All
UserAuthendicationMethod.ReadWrite.All

I added the above API permission and I got the response.

Answer 5

@AmanpreetSingh-MSFT I have all the required permission in my app registeration but still it show me 403 when i try to create user through postman or java sdk.

The error message that i got is
{
"error": {
"code": "Authorization_RequestDenied",
"message": "Insufficient privileges to complete the operation.",
"innerError": {
"date": "2022-04-30T14:37:36",
"request-id": "3d704d5d-4243-467c-9da8-a34aa0c85acb",
"client-request-id": "3d704d5d-4243-467c-9da8-a34aa0c85acb"
}
}
}

403 response status code.