Account synced from onprem ad. I update user using graph api as Azure AD application to update user properties. Permissions are all User.ReadWrite.All, Directory.ReadWrite.All listed in the document. Password, mobile phone, business phone, and accountenabled are all not set. The properties to include in the modification are as follows: usageLocation, userPrincipalName, mailNickname However, an error occurs in the efficient privileges to complete the operation (403). But if you try again over time, it succeed. Do you know why it happens??

Hi @ Heo Jaehyun This may be caused by delay, please do not try to get an access token immediately after you grant permissions and admin consent, it may take some time for the permissions to take effect, please wait half a minute or so and try again. Also, note that you must be an administrator to modify other users' information. Hope this helps. If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment .

Graph API: insufficient privileges to complete the operation(403)

Accepted answer

CarlZhao-MSFT 41,286 Reputation points

2023-03-10T09:50:20.0066667+00:00

Hi @Heo Jaehyun

This may be caused by delay, please do not try to get an access token immediately after you grant permissions and admin consent, it may take some time for the permissions to take effect, please wait half a minute or so and try again.

Also, note that you must be an administrator to modify other users' information.

Hope this helps.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.
Please sign in to rate this answer.
oops-9299 40 Reputation points

2023-03-13T00:05:12.52+00:00

I don't got an access token immediately after grant permissions and admin consent. I received 204 response code before the error occurred. And if you try again a few days later, it returns an 403 response code. This situation repeats over and over again.

CarlZhao-MSFT 41,286 Reputation points

2023-03-13T02:05:35.7+00:00

Hi @Heo Jaehyun

What authentication flow are you using? auth code flow or client credentials flow?

oops-9299 40 Reputation points

2023-03-13T02:14:54.6466667+00:00

I used client credentials flow.

oops-9299 40 Reputation points

2023-03-13T02:15:20.06+00:00

I used client credentials flow.

CarlZhao-MSFT 41,286 Reputation points

2023-03-13T02:21:19.0266667+00:00

Hi @Heo Jaehyun

Does this error occur when you modify some specific user or when you modify the same user?

oops-9299 40 Reputation points

2023-03-13T02:41:31.6533333+00:00

Hmm, yes, it happens when you modify for the same user.

At first, I thought it was caused by the expiration of the issued access token, but when the access token expires, it response 401 code.

403 errors are listed in the docs(https://learn.microsoft.com/en-us/graph/resolve-auth-errors), but not in any case. If the error continues to occur, I would think something is wrong, but I don't know the cause because success and failure are repeated.

CarlZhao-MSFT 41,286 Reputation points

2023-03-13T03:08:28.64+00:00

Hi @Heo Jaehyun

Did you only modify the three basic attributes "usageLocation, userPrincipalName, mailNickname" for the same user?

oops-9299 40 Reputation points

2023-03-13T04:19:22.1866667+00:00

Yes, I modified basic attributes. Additionally, this error does not occur frequently.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Graph API: insufficient privileges to complete the operation(403)

0 additional answers

Your answer