Change Azure AD B2C User Password with Graph API

Question

I'm trying to use the Sample Graph API app to change a user's password but I'm getting:

Error Calling the Graph API Response:

{
  "odata.error": {
    "code": "Authorization_RequestDenied",
    "message": {
      "lang": "en",
      "value": "Insufficient privileges to complete the operation."
    }
  }
}

Graph API Request:

PATCH /mytenant.onmicrosoft.com/users/some-guid?api-version=1.6 HTTP/1.1
client-request-id: ffd564d3-d716-480f-a66c-07b02b0e32ab
date-time-utc: 2017.08.10 03:04 PM

JSON File

{
    "passwordProfile": {
        "password": "Somepassword1$",
        "forceChangePasswordNextLogin": false
    }
}

I've tested updating the user's displayName and that works fine.

{
    "displayName": "Joe Consumer"
}

AD Application Permissions

I've configured my app permissions as described here.

Can you please post a correlation ID + timestamp from this error? — Daniel Dobalian
where is the correlation id? stackoverflow.com/questions/45593823/… — spottedmahn
How did you authorize the graph api reques? i mean how did you get bearer token ? — Venky

Parakh Parakh · Accepted Answer · 2017-08-15T21:03:39

Check out this article. Seems like it has the same symptoms.

Solution 1:

If you are receiving this error when you call the API that includes only read permissions, you have to set permissions in Azure Management Portal.

Go to Azure Management Portal and click Active Directory.
Select your custom AD directory.
Click Applications and select your Application.
Click CONFIGURE and scroll down to the section 'Permissions to other applications'.
Provide required Application Permissions and Delegated Permissions for Windows Azure Active Directory.
Finally save the changes.

Solution 2:

If you are receiving this error when you call the API that includes delete or reset password operations, that is because those operations require the Admin role of Company Administrator. As of now, you can only add this role via the Azure AD Powershell module.

Find the service principal using Get-MsolServicePrincipal –AppPrincipalId
```
Get-MsolServicePrincipal | ft DisplayName, AppPrincipalId -AutoSize
```

Use Add-MsolRoleMember to add it to Company Administrator role

$clientIdApp = 'your-app-id'
$webApp = Get-MsolServicePrincipal –AppPrincipalId $clientIdApp

Add-MsolRoleMember -RoleName "Company Administrator" -RoleMemberType ServicePrincipal -RoleMemberObjectId $webApp.ObjectId

To connect to your B2C tenant via PowerShell you will need a local admin account. This blog post should help with that, see "The Solution" section.

Change Azure AD B2C User Password with Graph API

2 Answers