How to create user (work account) on Azure Active Directory using Graph API

Question

I am relatively new to Azure Active Directory and the Graph API. My goal is to be able to write a python program which invokes the Graph APIs to create users in the Azure Active Directory. Let us assume that I have the credentials of the Global Admin for my Azure Active Directory.

I am following the documentation provided at this link. I am successfully able to create a user by using the Graph Explorer as I am using the Global Admin's credentials to login. However, I am unable to do the same via my python program (or even Postman REST client). I get an error message stating "Insufficient privileges to complete the operation." I am using the following python library to obtain an access token using the client credentials: ADAL python library

It looks like I am not following the correct procedure while obtaining the access token to make my call. I even tried obtaining the access token directly using a REST client. It would be great if someone could review the steps below to highlight any mistakes:

Step 1: Hit the following endpoint

[HTTPS]/login.microsoftonline.com/[my-organization]/oauth2/authorize?client_id=[client-id]&response_type=code&response_mode=query&resource=00000002-0000-0000-c000-000000000000

Step 2: Note down the 'code' query parameter from the above request. Then make the following request.

POST [HTTPS]/login.windows.net/[my-orgranization]/oauth2/token?api-version=1.0

HEADERS:

Content-type application/x-www-form-urlencoded

BODY:

code=[code received from Step 1]
client_id=[client id of my app in Azure]
client_secret=[client secret of my app in Azure]
grant_type=authorization_code
scope=openid

Please note that the values above were URL encoded appropriately.

I have even tried sending the global admin's credentials (username/password) in Step 2 as a last ditch effort but to no avail.

Any pointers in this regard would be greatly appreciated. Thanks in advance.

Answer 1

The error you are receiving is a result of the configuration of your application. Specifically, you need to configure your app to have the proper permissions to create users when calling the AAD Graph API.

Take a look here at the permission scopes available through the AAD Graph API.

To create users you will need either Directory.ReadWrite.All or Directory.AccessAsUser.All. You can check that you have done this all correctly by looking at your access token, and confirming that these claims appear in your access token.

If you do not have these claims, go back to your app registration and make sure to add the appropriate permissions to the AAD Graph API.

Note that when you update your application's permissions, you will need to force a consent prompt again to consent to the new permissions you are requesting, otherwise the authentication will continue to succeed with the OLD permissions you have requested. In order to force consent, simply add &prompt=consent to the end of the authorize URL.

Let me know if this helps!