403: Authorization_RequestDenied error when attempting to delete (some) users via API

Question

My API user has Global Administrator Role AND I've consented to all the User Permissions on the Graph Explorer. This same API user is who created the users I'm attempting to delete (fyi).

I build 4 users and put each user in a different group. (HR, IT, Marketing, ZAdmin are the groups). I only mention this because I'm only able to delete users who are in the Marketing group. Nothing else is different between the users. The users are literally created at the same time, with the same Python loop of code (just assigning them to different groups).

However, when attempting to delete the users via the API. https://graph.microsoft.com/v1.0/users/{user} (Where {user} is either the user's ID or their userPrincipalName.) I'm able to delete the Marketing assigned users but none of the other 3 users?!!!

Python requests.json() outputs the following error:

   {'code': 'Authorization_RequestDenied', 'message': 'Insufficient privileges to complete the operation.', 'innerError': {'date': '2022-07-11T17:10:50', 'request-id': '<blah>', 'client-request-id': '<blah>'}  

Thoughts on why I can't delete some users while consistently able to delete others?

Note: If I move a user from one of the other users to Marketing I'm then able to delete them.

Also Note: My API user is the owner of all these groups.

Answer 1

I'm unsure of what the exact setting was but there was a setting in the assigned groups that needed changed in order to make it such that I could delete the user. Alas, this group setting was unable to be changed after the group had been created so we had to move all the users to a new group, delete the existing group, recreate that group with the correct setting, and then move all the users back. Yucky!