Unable to GET /roleManagement/directory/roleEligibilityScheduleRequests with read-only permissions

PWhitmore 10 Reputation points
2024-04-15T13:55:30.3766667+00:00

We have discovered that a GET /roleManagement/directory/roleEligibilityScheduleRequests requires RoleEligibilitySchedule.ReadWrite.Directory or RoleManagement.ReadWrite.Directory even though this is a basic READ operation. The documentation lists read permissions as viable least-privileged options. However, we tested using RoleManagement.Read.All and RoleEligibilitySchedule.Read.Directory (both application and delegated) and they always returned this error:

RoleEligibilityScheduleRequestClient.BaseClient.Get(): unexpected status 403 with OData error: UnknownError: {"errorCode":"PermissionScopeNotGranted","message":"Authorization failed due to missing permission scope RoleEligibilitySchedule.ReadWrite.Directory,RoleManagement.ReadWrite.Directory.","instanceAnnotations":[]}

We are trying to leverage the related azuread_directory_role_eligibility_schedule_request Terraform resource that depends on MS Graph.

However, we are unable to run a terraform plan using a read-only credential in our acceptance pipeline due to this problem.

I have seen other related posts on this, but no solutions yet.

https://github.com/microsoftgraph/microsoft-graph-explorer-v4/issues/2176

Is this a known issue that is being worked on?

Thank you!

Microsoft Graph
Microsoft Graph
A Microsoft programmability model that exposes REST APIs and client libraries to access data on Microsoft 365 services.
10,620 questions
0 comments No comments
{count} votes