Microsoft Graph Application Permissions not working as documented

Question

I am seeing unauthorised errors where there should not be any according to the documentation.

The following query works as a User:
https://graph.microsoft.com/v1.0/groups/02bd9fd6-8f93-4758-87c3-1fb73740a315/members/microsoft.graph.user?$expand=manager (Sample Url taken from the Graph Explorer Sample Tenant, I just have a different GUID)
With an App Registration (Application not delegated) that has User.Read.All and
GroupMember.Read.All I get "Insufficient privileges to complete the operation."

What is interesting to me is that as an application it works if I do not expand the managers and I can query the member's managers individually. This is inconsistent and not in line with the API documentation.

Answer 1

Hello Alexander Jebens,

Good day. Hope all is well.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.

Thanks.

Answer 2

Hello Alexander Jebens,

Thanks for reaching out. To list Managers you need the following application permissions: User.Read.All, User.ReadWrite.All, Directory.Read.All, Directory.ReadWrite.All at a minimum. Please see article for more information. You can decrypt the token via https://jwt.ms to see if the token has the required permissions.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.

Thanks.