Powershell Graph set user Manager through an App using Set-MgUserManagerByRef

Question

I'm using an App with consented delegated permissions Directory.ReadWrite.All and User.ReadWrite.All. I'm using Set-MgUserManagerByRef to set the Manager property of an account like:

$body = @{
    grant_type    = "client_credentials"
    scope         = $scope
    client_id     = $clientId
    client_secret = $clientSecret
}
$tokenResponse = Invoke-RestMethod -Uri "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token" -Method Post -ContentType "application/x-www-form-urlencoded" -Body $body
    $accessToken = $tokenResponse.access_token

$newManagerRef = @{
    "@odata.id" = "https://graph.microsoft.com/v1.0/users/" + $manager.Id
}

# Update the manager property
Set-MgUserManagerByRef -UserId $adminuser.Id -BodyParameter $newManagerRef

Set-MgUserManagerByRef returns this error: Insufficient privileges to complete the operation. Status: 403 (Forbidden) ErrorCode: Authorization_RequestDenied.

What (permission) am I missing?

Regards, Paul

Answer 1

If you are using an app to update, then you need to use application level perms, not delegated perms