Not able to disable user account using accountEnabled=false

Ridhima Bhalerao 1

Hello,

I am trying to use the 'update' Graph API to disable user's account. This is the REST API I am using:

https://graph.microsoft.com/v1.0/users/dummyuser[@](/users/na/?userId=990f8a56-0000-0006-0000-000000000000).com

Request Body:
{
"accountEnabled":"false"
}

Unfortunately I get the following response:

"code": "Authorization_RequestDenied",
"message": "Insufficient privileges to complete the operation."

I am using the client_id and client_secret to get the OAUTH token. Although, I can update any other field for the same user using the same API call.

Is there anything that I am missing? Any help is appreciated.

Thank you!

James Hamil 21,546 Reputation points Microsoft Employee

2020-09-21T23:24:04.943+00:00

Hi, are there any updates with this case? If not, please select the appropriate response as "Answered." Otherwise please let us know how we can assist you.

5 answers

Carlos Castro Moreno 6 Reputation points

2020-12-15T08:23:20.33+00:00

Hi RidhimaBhalerao-8704,
Could you check if the user you want to disable has a role assigned to him?

In my case I can only change it to users who do not have any role assigned
Please sign in to rate this answer.

1 person found this answer helpful.
Tsvyatko Bikov 1 Reputation point

2022-08-30T11:46:40.03+00:00

Same, when try to disable account that has any kind of role assigned to it, the action fails.
Is there any resolution to that, or probably a workaround?
Sign in to comment
JamesTran-MSFT 36,361 Reputation points Microsoft Employee

2020-09-02T23:44:11.12+00:00
@Ridhima Bhalerao
Looking at your error message it looks like you might not have the correct permissions to disable the user's account. Are you trying to do this through Microsoft Graph Explorer?

I wasn't able to replicate your issue but will post my findings below: Using the Microsoft Graph API

Patch https://graph.microsoft.com/v1.0/users/testuser1@.domain.onmicrosoft.com Request Body - {"accountEnabled":"false"}

Once the command returned the appropriate response. I checked to make sure the account was actually disabled.

Get https://graph.microsoft.com/v1.0/users/testuser1@.domain.onmicrosoft.com?$select=accountEnabled

Please let me know if you have any questions.
Thank you for your time and patience throughout this issue!
Please sign in to rate this answer.
Ridhima Bhalerao 1 Reputation point

2020-09-03T13:49:28.51+00:00

Hi @JamesTran-MSFT ,

Thank you for the response, I am testing it in Postman. Are there any special permissions that need to be enabled in order to disable a user's account? I am using the client_id and client_secret to authorize the request. I have attached some screenshots for reference:

Thank you!

JamesTran-MSFT 36,361 Reputation points Microsoft Employee

2020-09-04T00:37:21.59+00:00

@Ridhima Bhalerao
Thanks for the info! I've reached out to our engineering team for further assistance on this issue.

Findings:
1-MS Graph API's access token is granting not only App permissions but also User consented permissions as well. Therefore, if you copy/paste the token to Postman, the operation will work.
2-However, if you just use Postman's token the operation fails, even if you have the proper permissions.

Using the MSGraph API, I copied the access token and put it into Postman: Operation succeeded

When using Postman's token with proper permissions: Operation Failed

If you have any questions in the meantime please let me know.
Thank you for your time and patience throughout this issue.

Ridhima Bhalerao 1 Reputation point

2020-09-04T14:55:39.763+00:00

Hi @JamesTran-MSFT ,

Thank you so much for your response, really appreciate it! You are right, your workflow works perfect for me too, but I need to achieve this through Java, so I am not sure if this workflow would work as expected,
because similar to Postman, I won't be able to grant permissions for the operation from the code right? Any thoughts around this one?

Thanks,
Ridhima

JamesTran-MSFT 36,361 Reputation points Microsoft Employee

2020-09-04T22:31:11.393+00:00

@Ridhima Bhalerao
Thanks for your response! I was able to reach out to our engineering team and will post their update below.

PG Update:
Can you give the application a Global Admin role and then try to update the "accountEnabled" property.

Steps:
1)Navigate to your Azure Active Directory
2)On the left blade, select "Roles and Administrators" - Search & Select "Global Admin"
3)Select "Add Assignments" at the top of the screen
4)Search for your App Registration -> Add the role to your App.

Retry the "accountEnabled" command via Postman.

I hope this helps!
Thank you for your time and patience throughout this issue.

JamesTran-MSFT 36,361 Reputation points Microsoft Employee

2020-09-08T17:18:56.167+00:00

@Ridhima Bhalerao
I just wanted to check in and see if you had a chance to review my previous post or if you had any other questions?

----------

If any reply/answer helped resolve your question, please remember to "mark as answer" so that others in the community facing similar issues can easily find the solution.
Sign in to comment
Bhanot Ravi 31 Reputation points

2020-09-03T18:49:39.673+00:00

Hi RidhimaBhalerao-8704,

Can you verify if the user ID that you are using has got "User Administrator" role assigned, if not try giving this role to your ID and then try executing the command or Patch Query.

User Administrator role has access to manage all aspects of users and groups.

Thanks,
Ravi
Please sign in to rate this answer.
Ridhima Bhalerao 1 Reputation point

2020-09-03T19:46:35.433+00:00

Hi Ravi (@Bhanot Ravi ),

Thank you for the response. I am using a client ID and a secret which is associated to an application in Azure AD.
I have given all the Directory Write rights and it has all the admin rights too. I am not sure why it doesn't work. I am able to update all the fields for any user except the 'accountEnabled' parameter.

Thanks,
Ridhima

Florek, Peter 1 Reputation point

2021-11-15T13:36:49.31+00:00

This may be too late to be useful, but it sounds like you are trying to use a token from the user to make the request to Graph. If you gave the API permissions to your app, I believe you need to generate a token on behalf of the app within the java code. So you call a graph /token endpoint using your client id and secret, and then pass your app token in your auth header for the subsequent call to Graph.

Get access without a user:
https://learn.microsoft.com/en-us/graph/auth-v2-service

(Assuming you already have admin consent, you can go to section 4)

Just be aware that anyone who can access these endpoints now has the same permissions as your application (not user specific), so be sure you are sufficiently checking the end user making the request.
Sign in to comment
Bhanot Ravi 31 Reputation points

2020-09-04T18:50:30.23+00:00

Thanks Ridhima for detailed answer. I would suggest let's wait for response from James as he is checking from Engineering team.

Thanks,
Ravi
Please sign in to rate this answer.

0 comments No comments
Sign in to comment
Bhanot Ravi 31 Reputation points

2020-09-09T18:31:32.71+00:00

HI Ridhima,

Could you please confirm if there is any progress.

Thanks,
Ravi
Please sign in to rate this answer.

0 comments No comments
Sign in to comment