Delete user using Graph API

Question

I am trying to delete user on Azure AD using the Graph Api but everytime i tried i came across error saying

Insufficient privileges to complete the operation.

After doing some research I found that we have to add application to “company administrators” role on Azure for delete user to work. When trying to add the role I am getting below error.

Add-MsolRoleMember : This role does not exist. Check the name and try again. At line:1 char:1 + Add-MsolRoleMember -RoleName "Company Administrator" -RoleMemberType ServicePrin ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : OperationStopped: (:) [Add-MsolRoleMember], MicrosoftOnlineException + FullyQualifiedErrorId : Microsoft.Online.Administration.Automation.RoleNotFoundException,Microsoft.Online.Admini stration.Automation.AddRoleMember

Answer 1

I believe you should be able to easily overcome this problem by using the RoleObjectId parameter in Add-MsolRoleMember.

I cover in my blog post here exactly how to do this using the MSOL PowerShell Module, and I use a few steps to first get the object Id of the Company Administrator role, and then assign it to the Service Principal.

Note that this will only affect the access your app has in your tenant.

Also you must already be a Company Administrator of the tenant to follow these instructions.

In order to make the change, you will need to install the Azure Active Directory PowerShell Module.

Once you have the module installed, authenticate to your tenant with your Administrator Account:

Connect-MSOLService

Then we need to get the Object ID of both the Service Principal we want to elevate, and the Company Administrator Role for your tenant.

Search for Service Principal by App ID GUID:

$sp = Get-MsolServicePrincipal -AppPrincipalId <App ID GUID>

Search for Directory Role by Name

$role = Get-MsolRole -RoleName "Company Administrator"

Now we can use the Add-MsolRoleMember command to add this role to the service principal.

Add-MsolRoleMember -RoleObjectId $role.ObjectId -RoleMemberType ServicePrincipal -RoleMemberObjectId $sp.ObjectId

To check everything is working, lets get back all the members of the Company Administrator role:

Get-MsolRoleMember -RoleObjectId $role.ObjectId

You should see your application in that list, where RoleMemberType is ServicePrincipal and DisplayName is the name of your application.

Now your application should be able to perform any Graph API calls that the Company Administrator could do, all without a user signed-in, using the Client Credential Flow.

Let me know if this works!

Answer 2

In-addition to Shawn Tabrize's solutlion. We can acquire the token which's contains corresponding permission to call the Graph API. For example, if you were requesting using Microsoft Graph REST, the Directory.AccessAsUser.All (refer here). And you need to use the admin of that tenant to acquire this access token in this scenario.

To check whether the token contains the correct permission, we can decode it from this site.