how to fix Remove-MgApplicationKey : Insufficient privileges to complete the operation ?

Question

Hi all,

I'm trying to make some graph powershell script to delete expired keys

I gave require scope for connect-graph (my id is global admin) , but still showing Insufficient privileges to complete the operation. Please help

this is the command on the scripts

$apiPermissionScopes = @("Auditlog.read.all", "Application.ReadWrite.All", "group.readwrite.all","Directory.ReadWrite.All", "IdentityRiskyUser.ReadWrite.All","DelegatedPermissionGrant.ReadWrite.All","User.readwrite.all","AppRoleAssignment.ReadWrite.All")

Connect-MgGraph-Scopes $apiPermissionScopes -ErrorAction Stop -NoWelcome

Remove-MgApplicationKey -ApplicationID $IDs.Id -KeyId $ExpiredKey

this is the result of error

Remove-MgApplicationKey : Insufficient privileges to complete the operation.

Status: 403 (Forbidden)

ErrorCode: Authorization_RequestDenied

Date: 2024-03-07T20:00:18

Headers:

Transfer-Encoding : chunked

Vary : Accept-Encoding

Strict-Transport-Security : max-age=31536000

request-id : 39648e85-3958-47b0-8659-39ea5079b345

client-request-id : 03e6186f-c5df-4678-a8b1-bc46a0280dc7

x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"Canada

Central","Slice":"E","Ring":"5","ScaleUnit":"002","RoleInstance":"YT2PEPF00000167"}}

x-ms-resource-unit : 1

Connection : keep-alive

Cache-Control : proxy-revalidate, no-cache

Date : Thu, 07 Mar 2024 20:00:17 GMT

Answer 1

Hi @Hartadi, Haryanto

First determine whether you are trying to delete the app's password or the certificate key credentials associated with the app.

If you are trying to remove expired key credentials from your app, you will also need to pass the proof attribute in the request body.

Import-Module Microsoft.Graph.Applications

$params = @{
	keyId = "f0b0b335-1d71-4883-8f98-567911bfdca6"
	proof = "eyJ0eXAiOiJ..."
}

Remove-MgApplicationKey -ApplicationId $applicationId -BodyParameter $params

If you are trying to remove an app's expired client secret, then you should call the /removePassword endpoint.

Import-Module Microsoft.Graph.Applications

$params = @{
	keyId = "f0b0b335-1d71-4883-8f98-567911bfdca6"
}

Remove-MgApplicationPassword -ApplicationId $appObjectId -BodyParameter $params

Hope this helps.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.