Needed permissions to create appRoleAssignment for an user

Question

I am trying to create an appRoleAssignment for an user. I see the same behavior using Microsoft Graph, the API or the Graph client. It works using Entra portal.

I have consented AppRoleAssignment.ReadWrite.All permission in Graph:

I am using the endpoint:

https://graph.microsoft.com/v1.0/users/{user-id}/appRoleAssignments

And the body and response are:

{
    "resourceId": "identifier of application with app roles",
    "appRoleId": "identifier of the app role",
    "principalId": "user-id"
}

And the response is:

{
    "error": {
        "code": "Authorization_RequestDenied",
        "message": "Insufficient privileges to complete the operation.",
        "innerError": {
            ...
        }
    }
}

Am I missing something? Is the permission correct?

Thank you.

Answer 1

Hello Francisco Javier Gomariz Abril,

Thank you for reaching out to Microsoft!!

For creating appRoleAssignment for a user using Graph API, in delegated scenarios please make sure one of the roles are present for the signed in user as per the official documentation referenced below:

Link: Create appRoleAssignment

Hope this helps.

If the answer is helpful, please click Accept Answer and kindly upvote it. If you have any further questions about this answer, please click Comment.

Answer 2

Hello Francisco Javier Gomariz Abril,

Thank you for reaching out to Microsoft Support!

According to the documentation, when using delegated permissions, the signed-in user must be assigned a supported Microsoft Entra role or a custom role with a supported role permission. As shown in the picture below:

Please check if your account has the above roles.

Reference document:

https://learn.microsoft.com/en-us/graph/api/user-post-approleassignments?view=graph-rest-1.0&tabs=http

Hope this helps.

If the answer is helpful, please click Accept Answer and kindly upvote it. If you have any further questions about this answer, please click Comment.

Answer 3

Thank you @Yakun Huang-MSFT @Akhil Nasalwai - MSFT for your answer. The signed-in user is already a User Administrator and Global Administrator, so I think it is not the problem. And the same happens when I use Application permissions with AppRoleAssignment.ReadWrite.All.

Always the same 403 response. Any other idea?

Thank you.