Why is our Azure Function webhook unable to modify user information in Azure Active Directory when the user is designated as a global administrator?

Question

Upon attempting to modify a user's information in Azure AD using my function, I encountered an issue where the function was unable to successfully update the user's details.

The function generally performs updates accurately for all user details, but it fails to do so when the user is designated as a global administrator, leading to the mentioned error.

Answer 1

@Anonymous

Thanks for your time and patience. From above descriptions it seems like you are trying to change user properties via AAD hosted function API.

To manage Global administrator user, the service / user account must have GA role assigned. A "user administrator" is the role with which you could manage all other users within the directory.

Since you are using Azure function API you must have given graph application User.ReadWrite.All permissions.

With the User.ReadWrite.All delegated or application permission, updating another user's businessPhones, mobilePhone or otherMails is only allowed on users who are non-administrators or assigned one of the following roles: Directory Readers, Guest Inviter, Message Center Reader and Reports Reader. For more details, see Helpdesk (Password) Administrator in Azure AD available roles.

Thanks,

Akshay Kaushik

Please "Accept the answer" (Yes), and share your feedback if the suggestion answers you’re your query. This will help us and others in the community as well.