"Insufficient privileges to complete the operation" while using Graph API

Anonymous
2020-12-14T17:46:54.273+00:00

The access token I get from the following curl request
curl "$IDENTITY_ENDPOINT?resource=https://graph.microsoft.com&api-version=2017-09-01" -H secret:$IDENTITY_HEADER
does not have the permission to list or create user.

Request:
GET /v1.0/users HTTP/1.1
Host: graph.microsoft.com
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJub......

Response
{
"error": {
"code": "Authorization_RequestDenied",
"message": "Insufficient privileges to complete the operation.",
"innerError": {
"date": "2020-12-14T17:27:10",
"request-id": "c172e8b7-ccf5-4ace-8c76-609d826787ce",
"client-request-id": "c172e8b7-ccf5-4ace-8c76-609d826787ce"
}
}
}

Curl request I made was from App service. I have enabled managed identity, and also added it as contributor in access control from subscription.
What am I doing wrong?

My goal is to get an access token from an App-Service as shown above and use it to create a user in azure ad.
If there is any alternative way it will be good.

Azure Role-based access control
Azure Role-based access control
An Azure service that provides fine-grained access management for Azure resources, enabling you to grant users only the rights they need to perform their jobs.
677 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,692 questions

7 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Mieszko Bugajski 0 Reputation points
    2023-01-20T12:14:01.8533333+00:00

    In the beginning thanks for previous posts it gave a lot of inspiration according topic. Problem occurred in our case at automated bicep mechanism that is supposed to add API permissions for Microsoft Graph.

    Error: Authorization_RequestDenied

    Solution:

    We needed to give Enterprise Application running mechanism Microsoft Graph (not Azure Active Directory Graph it will be deprecated) Application permissions:

    • Application.ReadWrite.All
    • AppRoleAssignment.ReadWrite.All
    • Directory.ReadWrite.All
    0 comments
  2. Sagar Ambesange 0 Reputation points
    2023-06-08T07:25:53.0333333+00:00

    I have gone through the various queries related to this topic, and may be mine is a duplicate.

    But I am kind of stuck with this now, kindly advice the solution to this.

    I have been using the Application authorisation to get users [https://graph.microsoft.com/v1.0/me] via graph API in postman.
    For this I have followed the comments and decoded the access token from https://jwt.ms

    I am seeing roles as in attached image in the decoded token:
    User's image

    Kindly suggest, what needs to be done to fix this.