Can't add member to a group in Azure Active Directory through Graph API

Question

I have the following code inside a Web API controller, some of it for debugging purposes:

public void Register([FromBody]AccountInfo accountInfo)
    {
        User user = new User();
        user.accountEnabled = true;
        user.displayName = accountInfo.UserName;
        user.userPrincipalName = string.Format(CultureInfo.InvariantCulture, "{0}@{1}", user.displayName, ConfigurationManager.AppSettings["TenantDomainName"]);
        user.mailNickname = accountInfo.UserName;
        user.passwordProfile.password = accountInfo.Password;
        user.passwordProfile.forceChangePasswordNextLogin = false;
        DirectoryService.AddTousers(user);
        DirectoryService.SaveChanges();

        Group securityGroup = DirectoryService.groups.Where(u => u.displayName.Equals(accountInfo.SecurityGroup)).First();
        User addedUser = DirectoryService.users.Where(u => u.objectId.Equals(user.objectId)).First();
        DirectoryService.LoadProperty(addedUser, "memberOf");
        DirectoryService.LoadProperty(securityGroup, "members");

        DirectoryService.AddLink(securityGroup, "members", addedUser);
        //securityGroup.members.Add(addedUser);
        var users = securityGroup.members.ToList();
        var links = DirectoryService.Links;
        //DirectoryService.UpdateObject(securityGroup);
        DirectoryService.SaveChanges();
    }

The above code adds a user in Windows Azure Active Directory and then attempts to add that user to a group. The user gets added to WAAD without any glitches, but the code fails on the last line with a

"http://schemas.microsoft.com/ado/2007/08/dataservices/metadata\">Authorization_RequestDeniedInsufficient privileges to complete the operation."

error message. It doesn't let me add a user to a group. Since my Service Principal has enough privileges to add a user to AAD, why wouldn't it be able to add a user to an existing group?

Emyode Emyode · Accepted Answer · 2014-01-08T21:56:28

You probably need to give proper access in the Azure portal and configure this in your project for a WEB APPLICATION AND/OR WEB API. This changes were made recently in the portal (before we had to do a lot of things using PowerShell).

We made an article explaining more or less how to configure everything:

http://www.clouddevx.com/en-us/Blog/ArtMID/836/ArticleID/2

EDIT:

just to give some more explanation what I think is that you probably have to set the service with informations about the Client ID and password obtained in the Azure portal:

var tenantName = "emyode.com";

string clientId = "clientId obtained in Azure portal";

string password = "security key obtained in Azure portal";

var token = DirectoryDataServiceAuthorizationHelper.GetAuthorizationToken(tenantName, clientId, password);

var graphService = new DirectoryDataService(tenantName, token);

Can't add member to a group in Azure Active Directory through Graph API

1 Answers