Change password using Graph API (Azure AD B2C)

Question

From angular front-end and webapi as back-end, I'm trying to consume Graph API change password function, but I get following error:

{"odata.error":{"code":"Authorization_RequestDenied","message":{"lang":"en","value":"Access to change password operation is denied."}}}

Below is my code:

           private async void ChangePasswordPostRequest(ChangePasswordModel changePasswordModel){
                AuthenticationResult result = await authContext.AcquireTokenAsync(ApplicationConstants.aadGraphResourceId, credential);
                HttpClient http = new HttpClient();
                string url = ApplicationConstants.aadGraphEndpoint + tenant + "/users/" + "c55f7d4d-f81d-4338-bec7-145225366565" + "/changePassword?" + ApplicationConstants.aadGraphVersion;         

                HttpRequestMessage request = new HttpRequestMessage(new HttpMethod("POST"), url);
                request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", result.AccessToken);

                request.Content = new StringContent(JsonConvert.SerializeObject(new ChangePasswordPostModel() { currentPassword = changePasswordModel.CurrentPassword, newPassword = changePasswordModel.NewPassword }), Encoding.UTF8, "application/json");

                HttpResponseMessage response = await http.SendAsync(request);
                if (!response.IsSuccessStatusCode)
                {
                    string error = await response.Content.ReadAsStringAsync();
                    object formatted = JsonConvert.DeserializeObject(error);
                }
            }

I'm stuck at this, any help will be appreciated. Thanks in advance.

IIRC password reset requires pretty heavy rights for the app if using client credentials (as you seem to be doing). What app permissions have you given your app? Have you tried MS Graph API as well: developer.microsoft.com/en-us/graph/docs/api-reference/v1.0/api/… ? — juunas
Thank you @juunas for your reply. I have given all delegated and application permissions in AD B2C and I didn't try MS Graph API because all the user management operations are done using Graph API. For change password I followed this link: msdn.microsoft.com/en-us/library/azure/ad/graph/api/… — Raj Gupta
You need application permissions if you are making the call with only client id and secret (as it looks like you are). — juunas
I have cross checked and found all application permissions are assigned to the App. — Raj Gupta

FerronSW FerronSW · Accepted Answer · 2019-08-08T07:10:02

The change password operation can only be called on behalf of the signed-in user. An application can change the password for a user using the reset password operation. The application must be assigned to the user account administrator role to change the password for the user. @Chris Padgett

With the beta endpoint of the Graph API it's now possible to get it done without PowerShell!

//Get App ObjectId
https://graph.microsoft.com/beta/servicePrincipals?$filter=appId eq '{appId}'

//Get roleId User Account Administrator role
GET: https://graph.microsoft.com/v1.0/directoryRoles?$filter=roleTemplateId eq 'fe930be7-5e62-47db-91af-98c3a49a38b1'

//If not found //Activate
POST: https://graph.microsoft.com/v1.0/directoryRoles

{
  "displayName": "User Account Administrator",
  "roleTemplateId": "fe930be7-5e62-47db-91af-98c3a49a38b1"
}

//Add member
POST: https://graph.microsoft.com/beta/directoryRoles/{Id}/members/$ref
{
  "@odata.id": "https://graph.microsoft.com/beta/servicePrincipals/{Id returned in first request}"
}

Change password using Graph API (Azure AD B2C)

2 Answers