Authorization_RequestDenied: "Insufficient Privileges" When Attempting to Update User Password via Microsoft Graph API (PATCH)

Question

I have a few clarifications and additional context to provide:

About the Issue:

• My app already has User.ReadWrite.All and Directory.ReadWrite.All permissions granted with admin consent.
  • The app is performing the operation with application permissions, not delegated permissions.
    • The user is a member of the directory and was successfully created during a migration process using a random password.
    Operation Details:

        - I'm attempting to update the user's password via a PATCH request to `https://graph.microsoft.com/v1.0/users/{user-id}`.
        
        
           - The request body contains the `passwordProfile` object with the new password and `forceChangePasswordNextSignIn` set to `false`.
        ```1. **Your Suggestion:**
    
    

  • Roles are not currently available in azure ad b2c to be assigned to app registrations. therefore i cannot follow your previous suggestion of providing the user.admin role to the app registration in azure ad b2c tenant.
  • Is there another prerequisite or configuration required to make this work?

Additional Notes:

• The error is Authorization_RequestDenied, stating "Insufficient privileges to complete the operation."
  • There are no conditional access policies or other restrictions that would interfere with this operation. here is the error message i see in the server logs with the request id and client request id: Unexpected Exception: Graph API Error: {"error":{"code":"Authorization_RequestDenied","message":"Insufficient privileges to complete the operation.","innerError":{"date":"2024-12-10T16:44:09","request-id":"db7efa4e-cddb-4535-b5fe-fa00b2fa3e14","client-request-id":"db7efa4e-cddb-4535-b5fe-fa00b2fa3e14"}}}

Answer 1

Hello Ray Garg,

Thank you for reaching out to Microsoft Support!

Judging from your parsed token, the permissions granted are sufficient, for this, we did the same test as you did, initially when we only granted the application permissions User.ReadWrite.All, we had the same error as you when changing the password, 403 permissions are insufficient.

According to the documentation, it is necessary to grant the application User Administrator role, for which we grant the application administrator role in Azure AD, as shown below:

After the role is granted, the token is obtained again, and the response is successful in the re-test. The test result is as shown in the following figure:

Check that the application is granted permission in Microsoft Entra ID->Roles and administrators->User Administrator.

Hope this helps.

If the answer is helpful, please click Accept Answer and kindly upvote it. If you have any further questions about this answer, please click Comment.