'Insufficient Privileges' error while using 'addKey' action in Azure AD Graph API

Question

I have an application registered in Azure AD which uses certificates. I am trying to write a script which would add a new certificate to the application. This can be used to add a new certificate when the existing certificate is going to expire.

I am trying to use AddKey function of Azure AD Graph API. The request body of this api as a parameter 'proof' which is a JWT assertion signed by the existing certificate of the application. The doc says the "aud" claim in JWT should be set to "AAD Graph SPN". Here what is meant by "AAD Graph SPN"?

I tried with a JWT where "aud" was set to "00000002-0000-0000-c000-000000000000". But I am getting the following error,

{
 "odata.error": {
    "code":"Authorization_RequestDenied",
     "message":{
        "lang":"en",
         "value":"Insufficient privileges to complete the operation."
      }
  }
}

Any thoughts on this?

I am getting the access token to call the Azure AD Graph API via "Resource Owner Credentials Grant" flow . To get the access token i am using the client_id "1950a258-227b-4e31-a9cf-717495945fc2" (The Well Known Client ID for Azure PowerShell")

My script (For deployment purpose) does something like below,

i) Get the access token as described above and registers a new application in Azure AD with a initial certificate.

ii) When the initial certificate is about to expire it should add a new certificate to the created application.

Shawn Tabrizi Shawn Tabrizi · Accepted Answer · 2017-11-28T23:07:21

According to the documentation, you must use a self-signed JWT token to access that API:

As part of the request validation for this service action, a proof of possession of an existing key is verified before the action can be performed. The proof is represented by a self-signed JWT token. The requesting application needs to generate a self-signed JWT token with the following requirements...

The "Resource Owner Credentials Grant" won't work here in this situation. Instead, use the "Client Credentials Grant":

https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-protocols-oauth-service-to-service

The application you want to update should be the Client ID used to get this access token.

The other option is to update the application directly using an PATCH request on the Application Object:

https://msdn.microsoft.com/en-us/library/azure/ad/graph/api/entity-and-complex-type-reference#application-entity

Using this method, you should be able to update using the method you described above (user credentials and an external Client ID)

Let me know if this helps.

'Insufficient Privileges' error while using 'addKey' action in Azure AD Graph API

1 Answers