Insufficient permissions to perform requested operation

Question

We are creating a flow to add a guest user to Azure AD.

Reference Article https://www.timlinenterprises.com/how-to-invite-external-users-using-microsoft-flow-and-microsoft-graph-api/

Followed the steps in the article and got the error as shown below while executing the flow

Insufficient privileges to perform requested operation by the application '00000003-0000-0000-c000-000000000000'. ControllerName=MSGraphInviteAPI, ActionName=CreateInvite, URL absolute path=/api/a65449db-d753-4811-b4e1-846b9be25a50/invites

Below is the screenshot of the HTTP Request from Flow

HTTP Request in Flow

HTTP Request in Flow 2

Below is the screenshot of the API Permissions on Azure

Azure API Permissions

As soon as I replace .onmicrosoft.com with the Tenant ID ,the flow executes without any issues and the guest user receives the invitation. The user gets added to Azure AD however their profiles do not show up on office 365 Guest users nor under SharePoint User Profile even after waiting for 24 hours.

Whenever I invite a guest user using graph explorer , the guest is added successfully to Azure , Office 365 and SharePoint

Graph Invitations Execution

Response to Post Request

This is a Global Admin account with all the privileges and E3 license assigned.

All the articles online show you how to add guests on Azure AD , However there is no info if the user would show up on Office 365 Guest List.

Please let me know if anyone is aware of this and can help me the steps to get this resolved , also let me know if any other details are needed from my end.

EDIT

1. There was a small confusion , I confused Tenant ID with Client ID , after entering the Tenant ID the flow works without any issues as show below

enter image description here

1. As soon as I enter .onmicrosoft.com under the tenant section , the flow fails
2. We have just 1 tenant where Azure Application is created

Please let me know if anything else needs to be checked

Thanks in advance.

Answer 1

As soon as I replace .onmicrosoft.com with the client ID ,the flow executes without any issues

It's impossible. You can only put tenant ID or domain name here. "client id" doesn't work.

In your case, a65449db-d753-4811-b4e1-846b9be25a50 should be the tenant id which you are trying to invite guest into.

Since the application permissions User.Invite.All and Directory.ReadWrite.All are correct, the reason why you get this issue is probably that you put a wrong tenant name here. The Azure AD app you registered is not in this tenant a65449db-d753-4811-b4e1-846b9be25a50. Please have a check.