Update-MgUser Error

Question

Update-MgUser Error

mitsu 81

excuse me.
Please let me know the reason for the command error.
The purpose is to change the password.

PS C:\WINDOWS\system32> $params = @{

> PasswordProfile = @{
> ForceChangePasswordNextSignIn = $false
> Password = "Test_Test111"
> }
> }

PS C:\WINDOWS\system32> Update-MgUser -UserId "******@XXXXXXX.onmicrosoft.com" -BodyParameter $params

Update-MgUser : Insufficient privileges to complete the operation.

0 comments

Answer accepted by question author

Vasil Michev 126.8K MVP Volunteer Moderator

As the error message suggests, you don't have permissions to update the password on said user. For this operation to succeed when run against a privileged (admin) user, you need to run it as a Global Administrator assigned the Directory.AccessAsUser.All permission.

mitsu 81 Reputation points

2022-08-30T08:22:01.467+00:00

thank you for your answer.
I've added Directory.AccessAsUser.All to the API, but the situation remains the same.
By the way, is it possible to change the password with Reset-MgUserAuthenticationMethodPassword?
However, I don't know which value to put in "-AuthenticationMethodId".
Vasil Michev 126.8K Reputation points MVP Volunteer Moderator

2022-08-30T10:21:07.567+00:00

Same requirements apply to using the AuthenticationMethod cmdlet/API endpoint. You can use Get-MgUserAuthenticationPasswordMethod to list the AuthenticationMethodId, or you can just use the default value of "28c10230-6103-485e-b985-444c60001490". But again, you need the relevant permissions for this to work.
mitsu 81 Reputation points

2022-09-01T02:08:36.057+00:00
I would like to change my password by following the steps below.
Insufficient privileges to complete the operation prints.
I really don't understand. please tell me.

Application creation

Add access permission
　　Directory.AccessAsUser.All　　←Delegated

Import-Module -Name Microsoft.Graph.Users

Connect-MgGraph -Clientid "" -TenantId "" -CertificateThumbprint ""

command execution
　　$params = @{
PasswordProfile = @{
ForceChangePasswordNextSignIn = $True
password=""
}
}
　　Update-MgUser -UserId "" -BodyParameter $params
Vasil Michev 126.8K Reputation points MVP Volunteer Moderator

2022-09-01T05:42:59.777+00:00

You are mixing things here. When using certificate-based auth, you are using application permissions, not delegate ones. You can easily verify that by running Get-MgContext.
To get this working, connect as a user that has sufficient permissions (such as Global admin) AND make sure the Directory.AccessAsUser.All scope is granted.
mitsu 81 Reputation points

2022-09-01T07:26:53.143+00:00

thank you for your answer.
Get-MgContext

=============

User. ReadWrite. All
UserAuthenticationMethod.ReadWrite.All
Directory. ReadWrite. All
Group. ReadWrite. All
Organization. Read. All

=============

to the script
Connect-MgGraph -Scopes "Directory.AccessAsUser.All"
I wrote it, but the login screen is displayed.
Please tell me how to prevent it from appearing.
mitsu 81 Reputation points

2022-09-01T08:36:38.87+00:00

excuse me.
I saw your previous answer.
https://learn.microsoft.com/en-us/answers/questions/953380/powershellmicrosoftgraph-reset-user-password.html
What I want to do is change the password of another user with a script
Not supported for application connections.
If you execute user context (Connect-MgGraph) and log in, it will be cached, so you can log in from the next time unless the token expires or Disconnect-MgGraph is executed.
do you mean.
Vasil Michev 126.8K Reputation points MVP Volunteer Moderator

2022-09-01T09:49:02.413+00:00

Not sure I understand the question. You cannot/should not be using application auth methods, such as CBA, for this operation. You need to login as a user, and that's only interactive, either via the standard MSAL prompt or by leveraging the device auth flow. Alternatively, you can obtain a token outside of the module and pass it via the -AccessToken parameter.
mitsu 81 Reputation points

2022-09-02T04:57:40.267+00:00

thank you for your answer.
Ron 66 Reputation points

2023-03-08T14:30:41.12+00:00

Already 6 months passed but no answer.
I'm facing the same challenge.

Anyone?
LB 11 Reputation points

2023-08-24T15:20:29.2966667+00:00
Hi @Vasil Michev , thanks for that, I had the same issue and it works once I connect using

Connect-MgGraph -Scopes "Directory.AccessAsUser.All"

My question here is why Directory.AccessAsUser.All is not listed as a needed permission for Update-MgUser cmdlet?

Update-MgUser with the listed permissions below works well to change other user attributes, but when one of the parameters is to change forceChangePasswordNextSignIn, then it fails with lack of permission when connected without the Directory.AccessAsUser.All scope.

When getting the needed permissions using Find-MGGraphCommand it does not list Directory.AccessAsUser.All. AmI doing something wrong on my Find-MGGraphCommand search?
Vasil Michev 126.8K Reputation points MVP Volunteer Moderator

2023-08-24T15:47:27.5566667+00:00

It's a "special" permissions, roughly equivalent to "impersonation", so Microsoft doesn't explicitly add it.
LB 11 Reputation points

2023-08-24T15:58:47.39+00:00

Thanks for the quick reply Vasil. IMO Microsoft should add all necessary scopes/permissions needed for a Graph cmdlet to fully work, otherwise I have no idea how to figure them out, but thanks to your initial reply I got it working.

3 additional answers

Your answer

mitsu 81 Reputation points

2022-08-30T08:22:01.467+00:00

thank you for your answer.
I've added Directory.AccessAsUser.All to the API, but the situation remains the same.
By the way, is it possible to change the password with Reset-MgUserAuthenticationMethodPassword?
However, I don't know which value to put in "-AuthenticationMethodId".
Vasil Michev 126.8K Reputation points MVP Volunteer Moderator

2022-08-30T10:21:07.567+00:00

Same requirements apply to using the AuthenticationMethod cmdlet/API endpoint. You can use Get-MgUserAuthenticationPasswordMethod to list the AuthenticationMethodId, or you can just use the default value of "28c10230-6103-485e-b985-444c60001490". But again, you need the relevant permissions for this to work.
mitsu 81 Reputation points

2022-09-01T02:08:36.057+00:00

I would like to change my password by following the steps below.
Insufficient privileges to complete the operation prints.
I really don't understand. please tell me.

Application creation

Add access permission
　　Directory.AccessAsUser.All　　←Delegated

Import-Module -Name Microsoft.Graph.Users

Connect-MgGraph -Clientid "" -TenantId "" -CertificateThumbprint ""

command execution
　　$params = @{
PasswordProfile = @{
ForceChangePasswordNextSignIn = $True
password=""
}
}
　　Update-MgUser -UserId "" -BodyParameter $params
Vasil Michev 126.8K Reputation points MVP Volunteer Moderator

2022-09-01T05:42:59.777+00:00

You are mixing things here. When using certificate-based auth, you are using application permissions, not delegate ones. You can easily verify that by running Get-MgContext.
To get this working, connect as a user that has sufficient permissions (such as Global admin) AND make sure the Directory.AccessAsUser.All scope is granted.
mitsu 81 Reputation points

2022-09-01T07:26:53.143+00:00

thank you for your answer.
Get-MgContext

=============

User. ReadWrite. All
UserAuthenticationMethod.ReadWrite.All
Directory. ReadWrite. All
Group. ReadWrite. All
Organization. Read. All

=============

to the script
Connect-MgGraph -Scopes "Directory.AccessAsUser.All"
I wrote it, but the login screen is displayed.
Please tell me how to prevent it from appearing.
mitsu 81 Reputation points

2022-09-01T08:36:38.87+00:00

excuse me.
I saw your previous answer.
https://learn.microsoft.com/en-us/answers/questions/953380/powershellmicrosoftgraph-reset-user-password.html
What I want to do is change the password of another user with a script
Not supported for application connections.
If you execute user context (Connect-MgGraph) and log in, it will be cached, so you can log in from the next time unless the token expires or Disconnect-MgGraph is executed.
do you mean.
Vasil Michev 126.8K Reputation points MVP Volunteer Moderator

2022-09-01T09:49:02.413+00:00

Not sure I understand the question. You cannot/should not be using application auth methods, such as CBA, for this operation. You need to login as a user, and that's only interactive, either via the standard MSAL prompt or by leveraging the device auth flow. Alternatively, you can obtain a token outside of the module and pass it via the -AccessToken parameter.
mitsu 81 Reputation points

2022-09-02T04:57:40.267+00:00

thank you for your answer.
Ron 66 Reputation points

2023-03-08T14:30:41.12+00:00

Already 6 months passed but no answer.
I'm facing the same challenge.

Anyone?
LB 11 Reputation points

2023-08-24T15:20:29.2966667+00:00

Hi @Vasil Michev , thanks for that, I had the same issue and it works once I connect using

Connect-MgGraph -Scopes "Directory.AccessAsUser.All"

My question here is why Directory.AccessAsUser.All is not listed as a needed permission for Update-MgUser cmdlet?

Update-MgUser with the listed permissions below works well to change other user attributes, but when one of the parameters is to change forceChangePasswordNextSignIn, then it fails with lack of permission when connected without the Directory.AccessAsUser.All scope.

When getting the needed permissions using Find-MGGraphCommand it does not list Directory.AccessAsUser.All. AmI doing something wrong on my Find-MGGraphCommand search?
Vasil Michev 126.8K Reputation points MVP Volunteer Moderator

2023-08-24T15:47:27.5566667+00:00

It's a "special" permissions, roughly equivalent to "impersonation", so Microsoft doesn't explicitly add it.
LB 11 Reputation points

2023-08-24T15:58:47.39+00:00

Thanks for the quick reply Vasil. IMO Microsoft should add all necessary scopes/permissions needed for a Graph cmdlet to fully work, otherwise I have no idea how to figure them out, but thanks to your initial reply I got it working.

Answer 1

D. Brooks 20

Thanks all for the help on this; I was looking for a way to run this as a one-off script and wanted to avoid having the application setup with delegated API permissions.

The fix for me was to just add this at the top of my script.

Connect-MgGraph -Scopes "Directory.AccessAsUser.All"

Then authenticating with a global admin gave me the correct access.

Here is my full script in-case anyone is looking for the same:

# Install the required modules - if not already installed
#Install-Module -Name Microsoft.Graph 

Import-Module Microsoft.Graph.Users

Connect-MgGraph -Scopes "Directory.AccessAsUser.All"

# Import users from CSV
$csvPath = "PATH\passwordReset.csv" #Containing Username and Password
Import-Csv $csvPath | ForEach-Object {
	$upn = $_."Username" + "@DOAMIN.org.uk"
	$params = @{
			passwordProfile = @{
				forceChangePasswordNextSignIn = $true
				password = $_."Password"
			}
			accountEnabled = $true
		}
	try {
		Update-MgUser -UserId $upn -BodyParameter $params
		Write-Host "Azure Password has been reset for: $upn"
	} catch {
		Write-Host "Failed to reset password for: $upn"
		Write-Host $_.Exception.Message
	}
}

Eduard Díaz Díaz 0 Reputation points

2023-08-08T12:45:32.37+00:00

This solutions works for me. Thanks!
James Tighe 51 Reputation points

2024-04-05T16:04:08.37+00:00

This is the answer right here.

I was following a MS article to set OnPremisesImmutableID with Update-MgUser and it kept failing with "Insufficient privileges to complete the operation"

Adding the Directory.AccessAsUser.All fixed this!

Thanks!

Answer 2

Schulz, James 10

Directory.AccessAsUser.All does not exist. now what?

0 comments

Answer 3

Schulz, James 10

Directory.AccessAsUser.All does not exist. now what.

0 comments

Share via

Update-MgUser Error

3 additional answers

Your answer