Unable to create Federation Configuration via Graph API

Question

Hello,

since the MSOnline and AzureAD PS Modules are deprecated I wanted to make myself familiar with the Graph API.

One of the things I tried to achive is switching a domain from "managed" to "federated".

So I tried to create a new Federation Configuration with the "New-MGDomainFederationConfiguration" cmdlet.

However, regardless of what I do/change, I always get the error "New-MgDomainFederationConfiguration : Insufficient privileges to complete the operation."

I connected to Graph with "Connect-MgGraph -Scopes Domain.ReadWrite.All". According to the documentation of the cmdlet, the "Domain.ReadWrite.All" Scope is the only scope necessary. The permisson has been consent for the tenant by the admin.

I also tried to do achieve my goal using Graph Explorer - with the same result.

Can someone pls help me get this done?

Thanks!

Christian

Answer 1

Nevermind. I found the solution myself. This is a known issue as documented here:

https://developer.microsoft.com/en-us/graph/known-issues/?search=21445

As a workaround one needs to grant Directory.AccessAsUser.All permissions.

Cheers

Christian

Answer 2

I found the solution myself. This is a know issue as documented here:

https://developer.microsoft.com/en-us/graph/known-issues/?search=21445

Answer 3

I found the solution myself. This is a know issue. One needs to grant Directory.AccessAsUser.All in addition.

Answer 4

Hi @Schindler Christian

Yes, this is a known question that I answered earlier, but the post was deleted, and now I'm recapping it in the hope that you can flag the answer so that it can be seen by more people with similar questions.

More details can be found in this document.

Hope this helps.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.