Insufficient privileges to create group with Assingable to Role True

Question

I am trying to create group with "isAssignableToRole" true but I was getting
403 error.
then I added the "RoleManagement.ReadWrite.Directory" permissions as mentioned in docs i.e
The following is an example of the request. The calling user must be assigned the RoleManagement.ReadWrite.Directory permission to set the isAssignableToRole property or update the membership of such groups.

after adding the permissions also I am getting the same error.
please help me to resolve the same.

"
{
"description": "M365 Group assignable to a role",
"displayName": "Test Role assignable group",
"groupTypes": [
],
"isAssignableToRole": true,
"mailEnabled": true,
"securityEnabled": true,
"mailNickname": "contosohelpdeskadministrators"
}

Response:

"error": {  
    "code": "Authorization_RequestDenied",  
    "message": "Insufficient privileges to complete the operation.",  
    "innerError": {  
        "date": "2022-09-29T07:33:16",  
        "request-id": "a2031734-bf7a-4b30-abc4-5c9452d851ac",  
        "client-request-id": "a2031734-bf7a-4b30-abc4-5c9452d851ac"  
    }  
}  

}

Answer 1

Hi @Manish Aery ,

As per my research the signed in user must be global admin/ privileged admin to do this operation. Along with Directory.ReadWrite.All/ Group.ReadWrite.All we should configure RoleManagement.ReadWrite.Directory permission also. Please find the below screenshot also

Could you please check the user role and permission and update mailEnabled property to false. If you are still facing this issue , I would advise you to raise a support case with Microsoft Graph, a specialized Support Engineer will be able to assist you better.

You can raise technical support request from:
https://portal.azure.com/#view/Microsoft_Azure_Support/HelpAndSupportBlade/~/overview or https://admin.microsoft.com/#/support/requests.

Hope this helps.
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Answer 2

Hi @Manish Aery

The RoleManagement.ReadWrite.Directory permission is not enough, you must also be a Global Administrator or Privileged Role Administrator to create a group with "isAssignableToRole": true.

But even if you meet the above conditions will still get a 400 error, because your request body is trying to create mail-enabled security group. According to the official documentation, creating and managing mail-enabled security groups via the graph api is currently not supported, only create M365/security group.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.