B2C Graph API - insufficient permissions even when Directory.ReadWrite.All is enabled
0
Running out of things to try, can anyone please help?
Trying to run 'change password' via Postman
I get token using app id and secret
I can read data from the user profile no problem
I grant permissions to Graph API in Azure portal
I generate the token again, review it in jwt.io, sample
"Device.ReadWrite.All",
"Member.Read.Hidden",
"Directory.ReadWrite.All",
"Domain.ReadWrite.All",
"Application.ReadWrite.OwnedBy",
"Application.ReadWrite.All"
],
I send
"password": "Test123456",
"forceChangePasswordNextLogin": false
to https://graph.windows.net/[tenant]/users/[user]api-version=1.6
I still get a fail with the following
"code": "Authorization_RequestDenied",
"message": {
"lang": "en",
"value": "Insufficient privileges to complete the operation."
}
azure-ad-b2c azure-ad-graph-api
asked Nov 13 '18 at 12:51
Journeyman1234Journeyman1234
388
add a comment |
0
Running out of things to try, can anyone please help?
Trying to run 'change password' via Postman
I get token using app id and secret
I can read data from the user profile no problem
I grant permissions to Graph API in Azure portal
I generate the token again, review it in jwt.io, sample
"Device.ReadWrite.All",
"Member.Read.Hidden",
"Directory.ReadWrite.All",
"Domain.ReadWrite.All",
"Application.ReadWrite.OwnedBy",
"Application.ReadWrite.All"
],
I send
"password": "Test123456",
"forceChangePasswordNextLogin": false
to https://graph.windows.net/[tenant]/users/[user]api-version=1.6
I still get a fail with the following
"code": "Authorization_RequestDenied",
"message": {
"lang": "en",
"value": "Insufficient privileges to complete the operation."
}
azure-ad-b2c azure-ad-graph-api
asked Nov 13 '18 at 12:51
Journeyman1234Journeyman1234
388
What is the value foraudin the token?
– juunas
Nov 13 '18 at 13:00
@juunas - 00000002-0000-0000-c000-000000000000
– Journeyman1234
Nov 13 '18 at 16:50
Umm, that's weird. It should normally behttps://graph.windows.net. Try using that as theresourcewhen you acquire the token.
– juunas
Nov 13 '18 at 17:21
not sure where to put it - this is what my URL in postman looks like currently login.microsoftonline.com/[tenantid]/oauth2/token
– Journeyman1234
Nov 13 '18 at 18:20
add a comment |
0
0
0
Running out of things to try, can anyone please help?
Trying to run 'change password' via Postman
I get token using app id and secret
I can read data from the user profile no problem
I grant permissions to Graph API in Azure portal
I generate the token again, review it in jwt.io, sample
"Device.ReadWrite.All",
"Member.Read.Hidden",
"Directory.ReadWrite.All",
"Domain.ReadWrite.All",
"Application.ReadWrite.OwnedBy",
"Application.ReadWrite.All"
],
I send
"password": "Test123456",
"forceChangePasswordNextLogin": false
to https://graph.windows.net/[tenant]/users/[user]api-version=1.6
I still get a fail with the following
"code": "Authorization_RequestDenied",
"message": {
"lang": "en",
"value": "Insufficient privileges to complete the operation."
}
azure-ad-b2c azure-ad-graph-api
asked Nov 13 '18 at 12:51
Journeyman1234Journeyman1234
388
Running out of things to try, can anyone please help?
Trying to run 'change password' via Postman
I get token using app id and secret
I can read data from the user profile no problem
I grant permissions to Graph API in Azure portal
I generate the token again, review it in jwt.io, sample
"Device.ReadWrite.All",
"Member.Read.Hidden",
"Directory.ReadWrite.All",
"Domain.ReadWrite.All",
"Application.ReadWrite.OwnedBy",
"Application.ReadWrite.All"
],
I send
"password": "Test123456",
"forceChangePasswordNextLogin": false
to https://graph.windows.net/[tenant]/users/[user]api-version=1.6
I still get a fail with the following
"code": "Authorization_RequestDenied",
"message": {
"lang": "en",
"value": "Insufficient privileges to complete the operation."
}
azure-ad-b2c azure-ad-graph-api
azure-ad-b2c azure-ad-graph-api
asked Nov 13 '18 at 12:51
Journeyman1234Journeyman1234
388
asked Nov 13 '18 at 12:51
Journeyman1234Journeyman1234
388
asked Nov 13 '18 at 12:51
Journeyman1234Journeyman1234
388
asked Nov 13 '18 at 12:51
Journeyman1234Journeyman1234
388
asked Nov 13 '18 at 12:51
Journeyman1234Journeyman1234
388
388
What is the value foraudin the token?
– juunas
Nov 13 '18 at 13:00
@juunas - 00000002-0000-0000-c000-000000000000
– Journeyman1234
Nov 13 '18 at 16:50
Umm, that's weird. It should normally behttps://graph.windows.net. Try using that as theresourcewhen you acquire the token.
– juunas
Nov 13 '18 at 17:21
not sure where to put it - this is what my URL in postman looks like currently login.microsoftonline.com/[tenantid]/oauth2/token
– Journeyman1234
Nov 13 '18 at 18:20
add a comment |
What is the value foraudin the token?
– juunas
Nov 13 '18 at 13:00
@juunas - 00000002-0000-0000-c000-000000000000
– Journeyman1234
Nov 13 '18 at 16:50
Umm, that's weird. It should normally behttps://graph.windows.net. Try using that as theresourcewhen you acquire the token.
– juunas
Nov 13 '18 at 17:21
not sure where to put it - this is what my URL in postman looks like currently login.microsoftonline.com/[tenantid]/oauth2/token
– Journeyman1234
Nov 13 '18 at 18:20
What is the value for
aud in the token?– juunas
Nov 13 '18 at 13:00
What is the value for
aud in the token?– juunas
Nov 13 '18 at 13:00
@juunas - 00000002-0000-0000-c000-000000000000
– Journeyman1234
Nov 13 '18 at 16:50
@juunas - 00000002-0000-0000-c000-000000000000
– Journeyman1234
Nov 13 '18 at 16:50
Umm, that's weird. It should normally be
https://graph.windows.net. Try using that as the resource when you acquire the token.– juunas
Nov 13 '18 at 17:21
Umm, that's weird. It should normally be
https://graph.windows.net. Try using that as the resource when you acquire the token.– juunas
Nov 13 '18 at 17:21
not sure where to put it - this is what my URL in postman looks like currently login.microsoftonline.com/[tenantid]/oauth2/token
– Journeyman1234
Nov 13 '18 at 18:20
not sure where to put it - this is what my URL in postman looks like currently login.microsoftonline.com/[tenantid]/oauth2/token
– Journeyman1234
Nov 13 '18 at 18:20
add a comment |
1 Answer
1
active
oldest
votes
0
The change password permission isn't enabled in the same manner as the other permissions on the AD Graph API.
You need to set up a tenant admin local to the B2C tenant and then run the powershell commands as detailed here: https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-devquickstarts-graph-dotnet.
edited Nov 13 '18 at 23:54
Chris Padgett
5,860139
answered Nov 13 '18 at 17:48
AndyMAndyM
856616
I've already created that tenant, otherwise it simply isn't possible to even get the user profile information. I hadn't run the powershell commands tho, I'll look at that next
– Journeyman1234
Nov 13 '18 at 18:19
I spent a good few hours on this last night before finally finding the solution in the link above. The only difference might be that I'm working from a console app so I'm always opening in the context of that application rather than a logged in user.
– AndyM
Nov 13 '18 at 19:05
Specifically, the service principal for the registered application must be assigned to the User Account Administrator role, which has a role identifier of fe930be7-5e62-47db-91af-98c3a49a38b1.
– Chris Padgett
Nov 13 '18 at 23:57
Actually, it doesn't make sense to change the B2C (consumer)'s Password by the admin in the b2c tenant if it's not necessary. Currently, you cannot use application permissions to reset user's password. Try to get the token with delegated permissions. Otherwise, you need to assign user account admin role to the service principal.
– Wayne Yang - MSFT
Nov 16 '18 at 6:25
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53281429%2fb2c-graph-api-insufficient-permissions-even-when-directory-readwrite-all-is-en%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
0
The change password permission isn't enabled in the same manner as the other permissions on the AD Graph API.
You need to set up a tenant admin local to the B2C tenant and then run the powershell commands as detailed here: https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-devquickstarts-graph-dotnet.
edited Nov 13 '18 at 23:54
Chris Padgett
5,860139
answered Nov 13 '18 at 17:48
AndyMAndyM
856616
I've already created that tenant, otherwise it simply isn't possible to even get the user profile information. I hadn't run the powershell commands tho, I'll look at that next
– Journeyman1234
Nov 13 '18 at 18:19
I spent a good few hours on this last night before finally finding the solution in the link above. The only difference might be that I'm working from a console app so I'm always opening in the context of that application rather than a logged in user.
– AndyM
Nov 13 '18 at 19:05
Specifically, the service principal for the registered application must be assigned to the User Account Administrator role, which has a role identifier of fe930be7-5e62-47db-91af-98c3a49a38b1.
– Chris Padgett
Nov 13 '18 at 23:57
Actually, it doesn't make sense to change the B2C (consumer)'s Password by the admin in the b2c tenant if it's not necessary. Currently, you cannot use application permissions to reset user's password. Try to get the token with delegated permissions. Otherwise, you need to assign user account admin role to the service principal.
– Wayne Yang - MSFT
Nov 16 '18 at 6:25
add a comment |
0
The change password permission isn't enabled in the same manner as the other permissions on the AD Graph API.
You need to set up a tenant admin local to the B2C tenant and then run the powershell commands as detailed here: https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-devquickstarts-graph-dotnet.
edited Nov 13 '18 at 23:54
Chris Padgett
5,860139
answered Nov 13 '18 at 17:48
AndyMAndyM
856616
I've already created that tenant, otherwise it simply isn't possible to even get the user profile information. I hadn't run the powershell commands tho, I'll look at that next
– Journeyman1234
Nov 13 '18 at 18:19
I spent a good few hours on this last night before finally finding the solution in the link above. The only difference might be that I'm working from a console app so I'm always opening in the context of that application rather than a logged in user.
– AndyM
Nov 13 '18 at 19:05
Specifically, the service principal for the registered application must be assigned to the User Account Administrator role, which has a role identifier of fe930be7-5e62-47db-91af-98c3a49a38b1.
– Chris Padgett
Nov 13 '18 at 23:57
Actually, it doesn't make sense to change the B2C (consumer)'s Password by the admin in the b2c tenant if it's not necessary. Currently, you cannot use application permissions to reset user's password. Try to get the token with delegated permissions. Otherwise, you need to assign user account admin role to the service principal.
– Wayne Yang - MSFT
Nov 16 '18 at 6:25
add a comment |
0
0
0
The change password permission isn't enabled in the same manner as the other permissions on the AD Graph API.
You need to set up a tenant admin local to the B2C tenant and then run the powershell commands as detailed here: https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-devquickstarts-graph-dotnet.
edited Nov 13 '18 at 23:54
Chris Padgett
5,860139
answered Nov 13 '18 at 17:48
AndyMAndyM
856616
The change password permission isn't enabled in the same manner as the other permissions on the AD Graph API.
You need to set up a tenant admin local to the B2C tenant and then run the powershell commands as detailed here: https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-devquickstarts-graph-dotnet.
edited Nov 13 '18 at 23:54
Chris Padgett
5,860139
answered Nov 13 '18 at 17:48
AndyMAndyM
856616
edited Nov 13 '18 at 23:54
Chris Padgett
5,860139
edited Nov 13 '18 at 23:54
Chris Padgett
5,860139
edited Nov 13 '18 at 23:54
Chris Padgett
5,860139
5,860139
answered Nov 13 '18 at 17:48
AndyMAndyM
856616
answered Nov 13 '18 at 17:48
AndyMAndyM
856616
answered Nov 13 '18 at 17:48
AndyMAndyM
856616
856616
I've already created that tenant, otherwise it simply isn't possible to even get the user profile information. I hadn't run the powershell commands tho, I'll look at that next
– Journeyman1234
Nov 13 '18 at 18:19
I spent a good few hours on this last night before finally finding the solution in the link above. The only difference might be that I'm working from a console app so I'm always opening in the context of that application rather than a logged in user.
– AndyM
Nov 13 '18 at 19:05
Specifically, the service principal for the registered application must be assigned to the User Account Administrator role, which has a role identifier of fe930be7-5e62-47db-91af-98c3a49a38b1.
– Chris Padgett
Nov 13 '18 at 23:57
Actually, it doesn't make sense to change the B2C (consumer)'s Password by the admin in the b2c tenant if it's not necessary. Currently, you cannot use application permissions to reset user's password. Try to get the token with delegated permissions. Otherwise, you need to assign user account admin role to the service principal.
– Wayne Yang - MSFT
Nov 16 '18 at 6:25
add a comment |
I've already created that tenant, otherwise it simply isn't possible to even get the user profile information. I hadn't run the powershell commands tho, I'll look at that next
– Journeyman1234
Nov 13 '18 at 18:19
I spent a good few hours on this last night before finally finding the solution in the link above. The only difference might be that I'm working from a console app so I'm always opening in the context of that application rather than a logged in user.
– AndyM
Nov 13 '18 at 19:05
Specifically, the service principal for the registered application must be assigned to the User Account Administrator role, which has a role identifier of fe930be7-5e62-47db-91af-98c3a49a38b1.
– Chris Padgett
Nov 13 '18 at 23:57
Actually, it doesn't make sense to change the B2C (consumer)'s Password by the admin in the b2c tenant if it's not necessary. Currently, you cannot use application permissions to reset user's password. Try to get the token with delegated permissions. Otherwise, you need to assign user account admin role to the service principal.
– Wayne Yang - MSFT
Nov 16 '18 at 6:25
I've already created that tenant, otherwise it simply isn't possible to even get the user profile information. I hadn't run the powershell commands tho, I'll look at that next
– Journeyman1234
Nov 13 '18 at 18:19
I've already created that tenant, otherwise it simply isn't possible to even get the user profile information. I hadn't run the powershell commands tho, I'll look at that next
– Journeyman1234
Nov 13 '18 at 18:19
I spent a good few hours on this last night before finally finding the solution in the link above. The only difference might be that I'm working from a console app so I'm always opening in the context of that application rather than a logged in user.
– AndyM
Nov 13 '18 at 19:05
I spent a good few hours on this last night before finally finding the solution in the link above. The only difference might be that I'm working from a console app so I'm always opening in the context of that application rather than a logged in user.
– AndyM
Nov 13 '18 at 19:05
Specifically, the service principal for the registered application must be assigned to the User Account Administrator role, which has a role identifier of fe930be7-5e62-47db-91af-98c3a49a38b1.
– Chris Padgett
Nov 13 '18 at 23:57
Specifically, the service principal for the registered application must be assigned to the User Account Administrator role, which has a role identifier of fe930be7-5e62-47db-91af-98c3a49a38b1.
– Chris Padgett
Nov 13 '18 at 23:57
Actually, it doesn't make sense to change the B2C (consumer)'s Password by the admin in the b2c tenant if it's not necessary. Currently, you cannot use application permissions to reset user's password. Try to get the token with delegated permissions. Otherwise, you need to assign user account admin role to the service principal.
– Wayne Yang - MSFT
Nov 16 '18 at 6:25
Actually, it doesn't make sense to change the B2C (consumer)'s Password by the admin in the b2c tenant if it's not necessary. Currently, you cannot use application permissions to reset user's password. Try to get the token with delegated permissions. Otherwise, you need to assign user account admin role to the service principal.
– Wayne Yang - MSFT
Nov 16 '18 at 6:25
add a comment |
draft saved
draft discarded
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53281429%2fb2c-graph-api-insufficient-permissions-even-when-directory-readwrite-all-is-en%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
What is the value for
audin the token?– juunas
Nov 13 '18 at 13:00
@juunas - 00000002-0000-0000-c000-000000000000
– Journeyman1234
Nov 13 '18 at 16:50
Umm, that's weird. It should normally be
https://graph.windows.net. Try using that as theresourcewhen you acquire the token.– juunas
Nov 13 '18 at 17:21
not sure where to put it - this is what my URL in postman looks like currently login.microsoftonline.com/[tenantid]/oauth2/token
– Journeyman1234
Nov 13 '18 at 18:20