Question 103598 in Azure Question posted in
The official documentation to get you started can be found here.

Microsoft Azure – Assigning Microsoft Graph permissions to a regular user doesn't work

I understand the process of assigning Microsoft Graph permissions to a service principal. I can take the object id of the Microsoft Graph app, then use the https://graph.microsoft.com/v1.0/servicePrincipals/<id>/appRoleAssignedTo MSGraph endpoint, like described here.

My question is: can I do the same with a regular user? That is, when calling appRoleAssignedTo, specify the object id of a user in the principalId field. Can a regular user have application permissions (like MSGraph permissions), and how do I use them afterwards?

I tried to do the above and assign the RoleManagement.ReadWrite.Directory to a user. Then I logged in with az login and ran az account get-access-token --resource-type ms-graph.

With this token I tried to do an operation that requires the RoleManagement.ReadWrite.Directory permission, like assigning a role to another user, but it fails with Insufficient privileges to complete the operation..

Tags:

2

Answers


  1. 0

    Users can request the scope they need when using Connect-MgGraph, for example:

    Connect-MgGraph -Scopes "RoleManagement.ReadWrite.Directory"

    Which is the recommended approach, as it means that for that session they will only have access to the scopes that are necessary rather than any they’ve previously requested

    Login or Signup to reply.
  2. 0

    I tried to reproduce the same in my environment and got the same error as below:

    enter image description here

    Note that: Microsoft Graph API permissions can be assigned only to Service principals not users directly.

    When I tried to Connect-MgGraph as a normal user, I got the error like below:

    Connect-MgGraph -Scopes "RoleManagement.ReadWrite.Directory"

    enter image description here

    enter image description here

    I created an Azure AD Application and granted API permission as below:

    enter image description here

    I generated access token by using below parameters:

    GET https://login.microsoftonline.com/1810a95e-99f3-46e0-84e8-8a2aee05d830/oauth2/v2.0/token

client_id:ClientID
client_secret:*****
scope:RoleManagement.ReadWrite.Directory
grant_type:authorization_code
redirect_uri:RedirectUri
code:code

    enter image description here

    By using the above access token, I am able to assign directory role to the user successfully as below:

    POST https://graph.microsoft.com/v1.0/directoryRoles/roleTemplateId=88d8e3e3-8f55-4a1e-953a-9b9898b8876b/members/$ref
Content-type: application/json

{
  "@odata.id": "https://graph.microsoft.com/v1.0/directoryObjects/UserID"
}

    enter image description here

    Reference:

    Add graph api permission to user account by Harpreet Singh Matharoo

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search