Update approles for an Azure ActiveDirectory application using GraphApi

Question

I'm trying to update appRoles for an Azure AD application using GraphApi but get an error stating Authorization_RequestDenied with Insufficient privileges to complete the operation error.

I'm using PostMan to call Rest endpoint https://graph.windows.net//applications/d66c96ea-56fd-41c8-884b-fc0664792f7d?api-version=1.6

This is Body for may PATCH request:

{
    "appRoles": [
        {
          "allowedMemberTypes": [
            "User"
          ],
          "description": "Writer has the ability to create tasks",
          "displayName": "Writer",
          "id": "66ea9f02-31b0-40b2-94fb-67a408bc10e3",
          "isEnabled": true,
          "value": "Writer"
        }
      ]
}

I have added all permissions to Microsoft Graph and Windows Azure Active Directory from my AAD application.

I have 2 applications in AAD. One is called "PostMan" for PostMan OAuth2.0 so that I can get a bearer token. Another on is called "TaskTrackerApp" on which I'm trying to set appRoles via GraphApi.

Thanks for your help!

Answer 1

You can try to upgrade the role of the AD application you use to a administrator permission. Run the following commands in PowerShell:

Connect-MsolService
$ClientIdWebApp = '{your_AD_application_client_id}'
$webApp = Get-MsolServicePrincipal –AppPrincipalId $ClientIdWebApp
#use Add-MsolRoleMember to add it to "Company Administrator" role).
Add-MsolRoleMember -RoleName "Company Administrator" -RoleMemberType ServicePrincipal -RoleMemberObjectId $webApp.ObjectId 

Answer 2

What RequiredResourceAccess list you have configured on application "PostMan" and also the one who is making changes is he/she the owner of this application "TaskTrackerApp" or a global admin in the directory?

Answer 3

I hit this too this week. In my case trying to update the reply URLs. I cut down my request to eventually just trying to update the name of the app. Same thing, Insufficient privileges. Eventually tracked it down to the fact that an application cannot update another app IF it is not an owner of the app. e.g. Azure Portal->App Registrations->(Select App to Update)->Settings->Owners. In my case, in the "real world" case, the app I was trying to use to update was supposed to be the owner (because it was the app that created the updating app)

So in the OPs case the "PostMan" app would need to be listed as an owner of the "TaskTrackerApp"