GraphAPI: Create temporary access pass on behalf of user, error 403 self service not supported

Question

Hi,

I'm trying to create a temporary access pass with the /authentication/temporaryAccessPassMethods endpoint on behalf of the user.

Permission: UserAuthenticationMethod.ReadWrite (Delegated) is set connecly on the app registration.

When I call the API I get an 403 forbidden error with the following details:
{"error":{"code":"accessDenied","message":"Self-service operations are currently not supported for user {GUID].","innerError":{"message":"Self-service operations are currently not supported for user {GUID}

What am I missing here?

TAP is activated in my tenant for all users.

Thx in advance
Peter

Answer 1

Hi @Stapf, Peter

Azure AD TAP is still in public preview and currently does not support creating TAP for user self, you can only use administrators to create TAP for other users.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Yes thanks, that really help.

One point from my side: The Graph API Docu states that "acting on self" is possible and lists the permissions.
https://learn.microsoft.com/en-us/graph/api/temporaryaccesspassauthenticationmethod-post?view=graph-rest-beta&tabs=http

There should be a hint in the beta docu that this is currently not possible.

Is there any ETA when "acting on self" will be available ?

/Peter

Answer 3

Hi @Stapf, Peter ,

As it's stated in the API error message, creation of temporaryAccessPassAuthenticationMethod for self-user account is currently not supported or allowed. As you can see in the below screenshot from Azure portal, the same is the case even from Azure portal UI and "Add authentication method" option is disabled for the self-user account. Hence this restriction of not allowing temporaryAccessPassAuthenticationMethod for self-user account is applicable either using Azure portal UI or Graph API.

Create temporaryAccessPassAuthenticationMethod Graph API with UserAuthenticationMethod.ReadWrite.All Delegated permissions is working fine for the other users in the tenant, as you can see in the below example screenshot. As mentioned in this documentation, for delegated scenarios where an admin is acting on another user, the admin needs one of the following Azure AD roles:

• Global administrator
• Privileged authentication administrator
• Authentication administrator

Example :

POST https://graph.microsoft.com/beta/users/******@o365XXXX.onmicrosoft.com/authentication/temporaryAccessPassMethods  

Note : Temporary Access Pass Authentication Method Graph API is currently available only in Beta. APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported.

Hope this helps.

If the answer is helpful to you, please click "Accept Answer" and kindly upvote it. If you have additional questions about this answer, please click "Comment".