Insufficient privileges to complete the operation - Azure Active Directory

3
votes

I am trying to update an Azure Active Directory Application but I get the error message " Insufficient privileges to complete the operation" as shown below. I have full admin access and I have given the api both delegated and application permissions as shown below and user administrator role as well. I have done search on permissions and roles but still cant get it working.

enter image description here

Here is a screen shot of my permissions configurations.

enter image description here

1
azurepowershellazure-active-directory
Did you accepted grant admin consent after assigning API permission? - Md Farid Uddin Kiron
Yes! Admin consent was granted after assigning API permission. - Tovs
Which role you are belongs to and what are you trying to update? - Md Farid Uddin Kiron
@MdFaridUddinKiron I am the Global Administrator. I have created sample web AAD app successfully and in the process of deploying it, however, before deployment is complete I need to update the AAD app using by running this script .\UpdateApps.ps1 -armConfig .\ARMParameters.json -newAppsConfig .\NewApps.json the instructions are found here github.com/OfficeDev/office-add-in-saas-monetization-sample/… ) - Tovs

1 Answers

3
votes

When you run the Microsoft Graph Powershell Get-MgApplication, you need to login it with the command like below, including the Application.Read.All delegated permission.

Connect-Graph -Scopes "User.Read","Application.Read.All"

It will open a window, then you need to enter the code authenticate, select the account which is the Global admin, select Consent on behalf of your organization option, click the Accept like below.

enter image description here

After login, run Get-MgApplication, it will work fine.

enter image description here

In addition, actually the Microsoft Graph Powershell comamnds call different Graph APIs, to run different commands, you need to Connect-Graph with different permissions, e.g. if you want to run Update-MgApplication, you need to add Application.ReadWrite.All, to run Get-MgGroup, you need to add Group.Read.All.