Can we force password reset for other user's in AD for multiple time using graph api as of now on trying I get this error "error": { "code": "Authorization_RequestDenied","message": "Insufficient privileges to complete the ope" permisson}

Question

We have an integration by which we try to perform an action of force resetting a password of an user multiple time. For the newly created user it allows to reset the password once but after the the password is reset by the actual user on portal it does not allow to reset the password next attempt and runs into below error. We are using "User >> Update" graph endpoint for doing this.

We also saw similar case on stackoverflow - https://stackoverflow.com/questions/44313884/insufficient-privileges-for-password-reset

Is it something we can do with the graph api or any other way or microsoft does not offers such feasibility?

{
  "error": {
    "code": "Authorization_RequestDenied",
    "message": "Insufficient privileges to complete the operation.",
    "innerError": {
      "request-id": "",
      "date": ""
    }
  }
}

Answer 1

Hi @Parag Patwardhan

If you are trying to update a user's password credentials, then you must follow that prerequisite.

Additionally, updating a user’s password is a sensitive action. If you are trying to update an administrator’s password, then the logged-in user/service principal should have a higher role than the target user.

Please refer to who can perform sensitive actions: https://learn.microsoft.com/en-us/graph/api/resources/users?view=graph-rest-1.0#who-can-reset-passwords.

Hope this helps.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.

Answer 2

Hi @Parag Patwardhan

Thank you for posting this in Microsoft Q&A.

I understand that you want to reset password for other users.

I attempted to execute the query PATCH https://graph.microsoft.com/v1.0/users/{id} in my environment and it successfully run the query.

Required permissions: Directory.AccessAsUser.All, Directory.ReadWrite.All, User.ManagedIdentiites.All, User.readwrite.All.

Please try to run this query in Graph Explorer.

You can use the following Graph API query to reset a user's password. This operation requires UserAuthenticationMethod.ReadWrite.All delegated permissions to execute.

The ID of the password authentication method, referenced by {passwordMethods-id}, is always 28c10230-6103-485e-b985-444c60001490.

POST https://graph.microsoft.com/v1.0/users/{user_id}/authentication/methods/{

Content-type: application/json

{
    "newPassword": "Cuyo5459"
}
 

For your reference: https://learn.microsoft.com/en-us/graph/api/authenticationmethod-resetpassword?view=graph-rest-1.0&tabs=http

Hope this helps. Do let us know if you any further queries.

Thanks,

Navya

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.