Microsoft Graph API permissions not works, but yes Azure Active Directory Graph

Luis Sanchez 1 Reputation point
2021-06-22T12:03:01.553+00:00

Hi,

We have configured an app registration in our Azure AD, and we tried added some API permissions to know what we need to execute: 

az ad app update --id xxx --add replyUrls "https://example.com/testing/"

We realized that the right permissions are:

  • Azure Active Directory Graph:
    • Application.ReadWrite.OwnedBy
    • Directory.Read.All

But Azure Active Directory Graph will be deprecated, and we tried to change by same permissions on Microsoft Graph. In this case, we tried to update the applications with the previous command, and we recieved the message: Insufficient privileges to complete the operation

Could be this a bug on Api Permissions?

108191-apipermissions.png

Azure Role-based access control
Azure Role-based access control
An Azure service that provides fine-grained access management for Azure resources, enabling you to grant users only the rights they need to perform their jobs.
808 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. AmanpreetSingh-MSFT 56,601 Reputation points
    2021-06-23T12:52:45.977+00:00

    Hi @Luis Sanchez · Thank you for reaching out.

    The cmd az ad app update --id xxx --add replyUrls "https://example.com/testing/" still uses graph.windows.net (Azure AD Graph) and not graph.microsoft.com (Microsoft Graph). Which is why if you want to use this command, you need to keep Azure AD Graph permissions in place.

    There is no bug in Microsoft Graph API as I tested this out in my lab and it works with these permissions. Below are the steps I performed:

    1. Acquired an application token with below permissions:
      108653-image.png
    2. Made below patch call to update the redirect URI:
      108538-image.png
    3. Checked the application in the portal and confirmed that the redirect uri is updated:
      108569-image.png

    -----------------------------------------------------------------------------------------------------------

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.