B2C Graph API - insufficient permissions even when Directory.ReadWrite.All is enabled

Running out of things to try, can anyone please help?

Trying to run 'change password' via Postman

I get token using app id and secret

I can read data from the user profile no problem

I grant permissions to Graph API in Azure portal

I generate the token again, review it in jwt.io, sample

"Device.ReadWrite.All",
"Member.Read.Hidden",
"Directory.ReadWrite.All",
"Domain.ReadWrite.All",
"Application.ReadWrite.OwnedBy",
"Application.ReadWrite.All"

I send

"password": "Test123456",
"forceChangePasswordNextLogin": false

to https://graph.windows.net/[tenant]/users/[user]api-version=1.6

I still get a fail with the following

 "code": "Authorization_RequestDenied",
 "message": 
 "lang": "en",
 "value": "Insufficient privileges to complete the operation."

asked Nov 13 '18 at 12:51

Journeyman1234

488

What is the value for aud in the token?

– juunas
Nov 13 '18 at 13:00

@juunas - 00000002-0000-0000-c000-000000000000

– Journeyman1234
Nov 13 '18 at 16:50

Umm, that's weird. It should normally be https://graph.windows.net. Try using that as the resource when you acquire the token.

– juunas
Nov 13 '18 at 17:21

not sure where to put it - this is what my URL in postman looks like currently login.microsoftonline.com/[tenantid]/oauth2/token

– Journeyman1234
Nov 13 '18 at 18:20

add a comment |

Running out of things to try, can anyone please help?

Trying to run 'change password' via Postman

I get token using app id and secret

I can read data from the user profile no problem

I grant permissions to Graph API in Azure portal

I generate the token again, review it in jwt.io, sample

"Device.ReadWrite.All",
"Member.Read.Hidden",
"Directory.ReadWrite.All",
"Domain.ReadWrite.All",
"Application.ReadWrite.OwnedBy",
"Application.ReadWrite.All"

I send

"password": "Test123456",
"forceChangePasswordNextLogin": false

to https://graph.windows.net/[tenant]/users/[user]api-version=1.6

I still get a fail with the following

 "code": "Authorization_RequestDenied",
 "message": 
 "lang": "en",
 "value": "Insufficient privileges to complete the operation."

asked Nov 13 '18 at 12:51

Journeyman1234

488

What is the value for aud in the token?

– juunas
Nov 13 '18 at 13:00

@juunas - 00000002-0000-0000-c000-000000000000

– Journeyman1234
Nov 13 '18 at 16:50

Umm, that's weird. It should normally be https://graph.windows.net. Try using that as the resource when you acquire the token.

– juunas
Nov 13 '18 at 17:21

not sure where to put it - this is what my URL in postman looks like currently login.microsoftonline.com/[tenantid]/oauth2/token

– Journeyman1234
Nov 13 '18 at 18:20

add a comment |

Running out of things to try, can anyone please help?

Trying to run 'change password' via Postman

I get token using app id and secret

I can read data from the user profile no problem

I grant permissions to Graph API in Azure portal

I generate the token again, review it in jwt.io, sample

"Device.ReadWrite.All",
"Member.Read.Hidden",
"Directory.ReadWrite.All",
"Domain.ReadWrite.All",
"Application.ReadWrite.OwnedBy",
"Application.ReadWrite.All"

I send

"password": "Test123456",
"forceChangePasswordNextLogin": false

to https://graph.windows.net/[tenant]/users/[user]api-version=1.6

I still get a fail with the following

 "code": "Authorization_RequestDenied",
 "message": 
 "lang": "en",
 "value": "Insufficient privileges to complete the operation."

asked Nov 13 '18 at 12:51

Journeyman1234

488

Running out of things to try, can anyone please help?

Trying to run 'change password' via Postman

I get token using app id and secret

I can read data from the user profile no problem

I grant permissions to Graph API in Azure portal

I generate the token again, review it in jwt.io, sample

"Device.ReadWrite.All",
"Member.Read.Hidden",
"Directory.ReadWrite.All",
"Domain.ReadWrite.All",
"Application.ReadWrite.OwnedBy",
"Application.ReadWrite.All"

I send

"password": "Test123456",
"forceChangePasswordNextLogin": false

to https://graph.windows.net/[tenant]/users/[user]api-version=1.6

I still get a fail with the following

 "code": "Authorization_RequestDenied",
 "message": 
 "lang": "en",
 "value": "Insufficient privileges to complete the operation."

azure-ad-b2c azure-ad-graph-api

asked Nov 13 '18 at 12:51

Journeyman1234

488

asked Nov 13 '18 at 12:51

Journeyman1234

488

asked Nov 13 '18 at 12:51

Journeyman1234

488

asked Nov 13 '18 at 12:51

Journeyman1234

488

asked Nov 13 '18 at 12:51

Journeyman1234

488

What is the value for aud in the token?

– juunas
Nov 13 '18 at 13:00

@juunas - 00000002-0000-0000-c000-000000000000

– Journeyman1234
Nov 13 '18 at 16:50

Umm, that's weird. It should normally be https://graph.windows.net. Try using that as the resource when you acquire the token.

– juunas
Nov 13 '18 at 17:21

not sure where to put it - this is what my URL in postman looks like currently login.microsoftonline.com/[tenantid]/oauth2/token

– Journeyman1234
Nov 13 '18 at 18:20

add a comment |

What is the value for aud in the token?

– juunas
Nov 13 '18 at 13:00

@juunas - 00000002-0000-0000-c000-000000000000

– Journeyman1234
Nov 13 '18 at 16:50

Umm, that's weird. It should normally be https://graph.windows.net. Try using that as the resource when you acquire the token.

– juunas
Nov 13 '18 at 17:21

not sure where to put it - this is what my URL in postman looks like currently login.microsoftonline.com/[tenantid]/oauth2/token

– Journeyman1234
Nov 13 '18 at 18:20

What is the value for aud in the token?

– juunas
Nov 13 '18 at 13:00

@juunas - 00000002-0000-0000-c000-000000000000

– Journeyman1234
Nov 13 '18 at 16:50

Umm, that's weird. It should normally be https://graph.windows.net. Try using that as the resource when you acquire the token.

– juunas
Nov 13 '18 at 17:21

not sure where to put it - this is what my URL in postman looks like currently login.microsoftonline.com/[tenantid]/oauth2/token

– Journeyman1234
Nov 13 '18 at 18:20

add a comment |

1 Answer
1

active

oldest

votes

The change password permission isn't enabled in the same manner as the other permissions on the AD Graph API.

You need to set up a tenant admin local to the B2C tenant and then run the powershell commands as detailed here: https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-devquickstarts-graph-dotnet.

edited Nov 13 '18 at 23:54

Chris Padgett

6,330139

answered Nov 13 '18 at 17:48

AndyM

873716

I've already created that tenant, otherwise it simply isn't possible to even get the user profile information. I hadn't run the powershell commands tho, I'll look at that next

– Journeyman1234
Nov 13 '18 at 18:19

I spent a good few hours on this last night before finally finding the solution in the link above. The only difference might be that I'm working from a console app so I'm always opening in the context of that application rather than a logged in user.

– AndyM
Nov 13 '18 at 19:05

Specifically, the service principal for the registered application must be assigned to the User Account Administrator role, which has a role identifier of fe930be7-5e62-47db-91af-98c3a49a38b1.

– Chris Padgett
Nov 13 '18 at 23:57

Actually, it doesn't make sense to change the B2C (consumer)'s Password by the admin in the b2c tenant if it's not necessary. Currently, you cannot use application permissions to reset user's password. Try to get the token with delegated permissions. Otherwise, you need to assign user account admin role to the service principal.

– Wayne Yang - MSFT
Nov 16 '18 at 6:25

add a comment |

Your Answer

StackExchange.ifUsing("editor", function ()
StackExchange.using("externalEditor", function ()
StackExchange.using("snippets", function ()
StackExchange.snippets.init();
);
);
, "code-snippets");

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "1"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);

);

draft saved

draft discarded

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53281429%2fb2c-graph-api-insufficient-permissions-even-when-directory-readwrite-all-is-en%23new-answer', 'question_page');

);

Post as a guest

Name

Required, but never shown

1 Answer
1

active

oldest

votes

1 Answer
1

active

oldest

votes

The change password permission isn't enabled in the same manner as the other permissions on the AD Graph API.

edited Nov 13 '18 at 23:54

Chris Padgett

6,330139

answered Nov 13 '18 at 17:48

AndyM

873716

I've already created that tenant, otherwise it simply isn't possible to even get the user profile information. I hadn't run the powershell commands tho, I'll look at that next

– Journeyman1234
Nov 13 '18 at 18:19

I spent a good few hours on this last night before finally finding the solution in the link above. The only difference might be that I'm working from a console app so I'm always opening in the context of that application rather than a logged in user.

– AndyM
Nov 13 '18 at 19:05

Specifically, the service principal for the registered application must be assigned to the User Account Administrator role, which has a role identifier of fe930be7-5e62-47db-91af-98c3a49a38b1.

– Chris Padgett
Nov 13 '18 at 23:57

Actually, it doesn't make sense to change the B2C (consumer)'s Password by the admin in the b2c tenant if it's not necessary. Currently, you cannot use application permissions to reset user's password. Try to get the token with delegated permissions. Otherwise, you need to assign user account admin role to the service principal.

– Wayne Yang - MSFT
Nov 16 '18 at 6:25

add a comment |

The change password permission isn't enabled in the same manner as the other permissions on the AD Graph API.

edited Nov 13 '18 at 23:54

Chris Padgett

6,330139

answered Nov 13 '18 at 17:48

AndyM

873716

I've already created that tenant, otherwise it simply isn't possible to even get the user profile information. I hadn't run the powershell commands tho, I'll look at that next

– Journeyman1234
Nov 13 '18 at 18:19

I spent a good few hours on this last night before finally finding the solution in the link above. The only difference might be that I'm working from a console app so I'm always opening in the context of that application rather than a logged in user.

– AndyM
Nov 13 '18 at 19:05

Specifically, the service principal for the registered application must be assigned to the User Account Administrator role, which has a role identifier of fe930be7-5e62-47db-91af-98c3a49a38b1.

– Chris Padgett
Nov 13 '18 at 23:57

Actually, it doesn't make sense to change the B2C (consumer)'s Password by the admin in the b2c tenant if it's not necessary. Currently, you cannot use application permissions to reset user's password. Try to get the token with delegated permissions. Otherwise, you need to assign user account admin role to the service principal.

– Wayne Yang - MSFT
Nov 16 '18 at 6:25

add a comment |

The change password permission isn't enabled in the same manner as the other permissions on the AD Graph API.

edited Nov 13 '18 at 23:54

Chris Padgett

6,330139

answered Nov 13 '18 at 17:48

AndyM

873716

The change password permission isn't enabled in the same manner as the other permissions on the AD Graph API.

edited Nov 13 '18 at 23:54

Chris Padgett

6,330139

answered Nov 13 '18 at 17:48

AndyM

873716

edited Nov 13 '18 at 23:54

Chris Padgett

6,330139

edited Nov 13 '18 at 23:54

Chris Padgett

6,330139

edited Nov 13 '18 at 23:54

Chris Padgett

6,330139

answered Nov 13 '18 at 17:48

AndyM

873716

answered Nov 13 '18 at 17:48

AndyM

873716

answered Nov 13 '18 at 17:48

AndyM

873716

I've already created that tenant, otherwise it simply isn't possible to even get the user profile information. I hadn't run the powershell commands tho, I'll look at that next

– Journeyman1234
Nov 13 '18 at 18:19

I spent a good few hours on this last night before finally finding the solution in the link above. The only difference might be that I'm working from a console app so I'm always opening in the context of that application rather than a logged in user.

– AndyM
Nov 13 '18 at 19:05

Specifically, the service principal for the registered application must be assigned to the User Account Administrator role, which has a role identifier of fe930be7-5e62-47db-91af-98c3a49a38b1.

– Chris Padgett
Nov 13 '18 at 23:57

Actually, it doesn't make sense to change the B2C (consumer)'s Password by the admin in the b2c tenant if it's not necessary. Currently, you cannot use application permissions to reset user's password. Try to get the token with delegated permissions. Otherwise, you need to assign user account admin role to the service principal.

– Wayne Yang - MSFT
Nov 16 '18 at 6:25

add a comment |

I've already created that tenant, otherwise it simply isn't possible to even get the user profile information. I hadn't run the powershell commands tho, I'll look at that next

– Journeyman1234
Nov 13 '18 at 18:19

I spent a good few hours on this last night before finally finding the solution in the link above. The only difference might be that I'm working from a console app so I'm always opening in the context of that application rather than a logged in user.

– AndyM
Nov 13 '18 at 19:05

Specifically, the service principal for the registered application must be assigned to the User Account Administrator role, which has a role identifier of fe930be7-5e62-47db-91af-98c3a49a38b1.

– Chris Padgett
Nov 13 '18 at 23:57

Actually, it doesn't make sense to change the B2C (consumer)'s Password by the admin in the b2c tenant if it's not necessary. Currently, you cannot use application permissions to reset user's password. Try to get the token with delegated permissions. Otherwise, you need to assign user account admin role to the service principal.

– Wayne Yang - MSFT
Nov 16 '18 at 6:25

I've already created that tenant, otherwise it simply isn't possible to even get the user profile information. I hadn't run the powershell commands tho, I'll look at that next

– Journeyman1234
Nov 13 '18 at 18:19

I spent a good few hours on this last night before finally finding the solution in the link above. The only difference might be that I'm working from a console app so I'm always opening in the context of that application rather than a logged in user.

– AndyM
Nov 13 '18 at 19:05

Specifically, the service principal for the registered application must be assigned to the User Account Administrator role, which has a role identifier of fe930be7-5e62-47db-91af-98c3a49a38b1.

– Chris Padgett
Nov 13 '18 at 23:57

Actually, it doesn't make sense to change the B2C (consumer)'s Password by the admin in the b2c tenant if it's not necessary. Currently, you cannot use application permissions to reset user's password. Try to get the token with delegated permissions. Otherwise, you need to assign user account admin role to the service principal.

– Wayne Yang - MSFT
Nov 16 '18 at 6:25

add a comment |

draft saved

draft discarded

Thanks for contributing an answer to Stack Overflow!

Please be sure to answer the question. Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.

Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.

draft saved

draft discarded

Post as a guest

Name

Required, but never shown

Name

Required, but never shown

Name

Required, but never shown

This page is only for reference, If you need detailed information, please check here

搜尋此網誌

Pfthb