Create a security group under specific geo location, error "The requesting principal is not authorized to set group preferred data location"

Question

We have our tenant with 4 Geo locations. and inside power automate flow i am sending this Graph api to create a new security group under specific Geo location using service account (not using clientID and Client secret) :-

but i am getting this error:-

The requesting principal is not authorized to set group preferred data location.

 

now if i remove this parameter:-

"preferredDataLocation": "AUS",

the Office 365 group will gt created under the default location, but i need to add it to the specific location. the service account running the graph api call has SharePoint, group and teams admin permissions.

any advice?

Thanks

Answer 1

Hi @john john Pter 

Thank you for posting your question in the Microsoft Q&A forum. 

Please understand that our forum is a public platform, and we will modify your question to cover your organization domain name in the description. Please notice to hide these personal or organization information next time you post error or some information to protect personal data. 
As forum moderators, we have certain limitations in our test environment, which unfortunately prevent us from reproducing your scenario to investigate the issue directly. However, based on our research, the error you're encountering typically indicates that the service account making the Microsoft Graph API call lacks the necessary privileges to set the preferredDataLocation property. 

While your service account may currently hold SharePoint, Groups, and Teams admin roles, these roles do not grant permission to configure data residency settings. This action requires specific elevated permissions. 

To successfully set the preferredDataLocation property, you must: 

-Be assigned the Global Administrator role 

-If you're not a Global Admin, please contact someone who is and request the Directory Writers and PreferredDataLocation Writer role assignments via the Microsoft Entra admin center > Roles & Admins > Add assignments. 

If you switch to using client ID and secret (Entra ID app registration), ensure the app has the following delegated or application permissions: 

-Group.ReadWrite.All 

-Directory.ReadWrite.All 

-User.ReadWrite.All 

I hope this information is helpful. 

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".   

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.