Graph to Change Password: Insufficient privileges to complete the operation

Question

We have a Logic App in our tennant which should change a password , It has worked but the last time it gives errors.

In this WorkFlow there is a PATCH request to https://graph.microsoft.com/v1.0/users/@{items('For_each')?['UPNOrObjectId']} where we want to set a (temporary) password via

{
"passwordProfile": {
"forceChangePasswordNextSignIn": true,
"password": "@{body('Parse_TAPData')?['temporaryAccessPass']}"
}
}

The respons is a 403 error

{
"error": {
"code": "Authorization_RequestDenied",
"message": "Insufficient privileges to complete the operation.",
"innerError": {
"date": "2024-06-07T01:02:28",
"request-id": "4a7a1740-055d-4475-99bf-bf185cc07fe2",
"client-request-id": "4a7a1740-055d-4475-99bf-bf185cc07fe2"
}
}
}

The GET request to https://graph.microsoft.com/beta/users/@{items('For_each')?['UPNOrObjectId']}?$select=id,displayName,givenName,userPrincipalName,mail gives the detials of the user.

Also tested via an alternative REST client (outside AZURE) which gives the same results. We can request the details of a user but get the same 403 error on the PATCH request to set the password.

We checked the application rights for the app registration TAPRegistryReader thats behind the logic app.

According the documentation the passwordprofile call is part of the user entity which needs the following persmission grants:

Permission type	Least privileged permissions
Delegated (work or school account)	User.ReadWrite
Application	User.ManageIdentities.All

source: https://learn.microsoft.com/en-us/graph/api/user-list-oauth2permissiongrants?view=graph-rest-1.0&tabs=http

And even the Higher privileged permissions granted to the application keep giving the same error ("Insufficient privileges to complete the operation")
The application is also added to the role of Password Administrator. (the suggestion in https://learn.microsoft.com/en-us/answers/questions/1603872/what-additional-permission-do-i-need-to-update-a-u for Global Admin look to wide for me, but in the comment the Password Administrator seems right)

Looked also via https://developer.microsoft.com/en-us/graph/graph-explorer and even with alle suggested Permissions granted we get the same error.

Please advise and help to mitigate this isssue.

Answer 1

Hi @Bas Elbers

If you are using an application-only context, the above permissions are not sufficient, you must assign the calling application the User.ReadWrite.All application permission and at least the User Administrator Microsoft Entra role.

In addition, if you are trying to change the password for an administrator, the calling application must have the Global Administrator role.

Hope this helps.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.