MS Graph Insufficient privileges to complete the operation

Question

Repo Steps:

API URL is below:
https://graph.microsoft.com/v1.0/users

Screenshot of API Permission is below:

Error Response is below
{
"error": {
"code": "Authorization_RequestDenied",
"message": "Insufficient privileges to complete the operation.",
"innerError": {
"date": "2022-02-12T18:48:03",
"request-id": "74f4f18d-d18d-4065-b048-58664410297b",
"client-request-id": "74f4f18d-d18d-4065-b048-58664410297b"
}
}
}

Answer 1

Hi @xi ouyang

Please note the following:

1. Make sure you are not using the client credential flow.
2. Make sure you are using a work account and not a personal account.
3. Important: This error may also be caused if you are using a guest account, because guest users cannot enumerate all users by default, you need to set the same access permissions as members for guest users, or grant user administrators for your guest users. Log in to the Azure portal as a global administrator, and then go to: User settings>Manage external collaboration settings>Guest user access:

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Per discussion with Azure AD Support Team, the root cause is that I use delegate API instead of Application API. After adding the API permission type of delegation, it works as expected.

Answer 3

Are permissions the same thing as privileges?
Maybe they are... Adding ('consenting') permissions helped.
Weapon of mass-confusion?

Answer 4

Check your access token, make sure the permissions are reflected therein. You can use tools such as jtw.ms to decode it. If you don't see the permissions, request a new token.
Also, how are you authenticating? If using client secret/certificate, the permissions above do not apply.

Answer 5

Hi

I have the same issue

the service principal authenticates

we added group.readAll and user.readAll privileges as an application but still receiving insufficient privileges when use az ad group list

Any idea?