Share via

Changing password of accounts with privileged roles with a Service Principal

Colin 21 Reputation points
2024-01-24T18:56:18.2133333+00:00

Hello, Our IAM platform offers our users to change their Azure account password. Our platform uses the C# Graph SDK in order to change the password by authentication using a Service Principal. However, for certain accounts, the action fails with:

Microsoft.Graph.ServiceException: Code: Authorization_RequestDeniedMessage: Insufficient privileges to complete the operation.

Upon finding this page, I realize that our Service Principal would require "Privileged Authentication Administrator" if we would want to be able to change the password of any account in the directory. I am taking a chance here to ask you if there is a possibility to use a custom role instead as "Privileged Authentication Administator" would allow our Service Principal to do more than we would like. Or should I be considering a different approach? Thank you for your time.

Azure Role-based access control
Azure Role-based access control
An Azure service that provides fine-grained access management for Azure resources, enabling you to grant users only the rights they need to perform their jobs.
880 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
23,181 questions
0 comments
Accepted answer
  1. Vasil Michev 113.4K Reputation points MVP
    2024-01-25T08:35:36.01+00:00

    You cannot, as there is no possibility to create custom roles that can feature such permissions, currently. And yes, it's unfortunate that you cannot go granular, it's a common feedback for the Graph folks at Microsoft.

    0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.