Microsoft Graph Explorer Cannot Consent to Directory.AccessAsUser.All to add Directory Schema Extension property

0
votes

Updated!! OK I added my work AAD login as a guest and gave it Global Admin rights and Owner rights to the subscription. Now I get the modal popup as shown but when I try to consent to Directory.AccessAsUser.All it seems to want my work administrator. Is there a way I can fix this so I can use my personal Microsoft Account as an administrator so that I can continue testing?

enter image description here

I am having issues consenting to permissions in Microsoft Graph Explorer. I am using my personal Visual Studio Professional Azure account that I upgraded to a P2 license. I am trying to set a Directory Schema Extension and having no luck getting consent to work for permissions Directory.AccessAsUser.All all that happens is that the modal permissions dialog closes quickly whenever I press the consent button. In the API documentation Create extensionProperty Permissions

it indicates

One of the following permissions is required to call this API.

Delegated (work or school account) Application.ReadWrite.All, Directory.AccessAsUser.All

Delegated (personal Microsoft account) Not supported.

Application Application.ReadWrite.OwnedBy, Application.ReadWrite.All

But my Visual Studio Professional account uses my personal Microsoft account and its the global admin of AAD and Azure resources. Could this be the cause of my problems? If so is there a workaround? I have ben able to consent to the Application.ReadWrite permission consistently and I have tried to set the permissions from

enter image description here

as well as from enter image description here

1
azure-active-directorymicrosoft-graph-api
You added your "Visual Studio Professional account uses my personal Microsoft account" into another AAD tenant (we call it tenant A here) and you want to use this account to do admin consent for the tenant A in Microsoft Graph explorer? – Allen Wu

1 Answers

0
votes

OK here is the answer.

  • You have to associate a custom domain with the AAD associated with your Azure Visual Studio Professional account and make it the primary domain.
  • Then create a user under AAD that was a part of that custom domain.
  • Make that user a global administrator and owner of the subscription.
  • Log into Microsoft Graph Explorer as that user.

Then there are no problems doing the consent. Adding a custom domain seems to make it a work account so now I can continue trying to create this stupid extension property. Hope this helps someone else not spend 3 days on this problem. Damn it would be nice if Microsoft CLEARLY documented this. Since I had 2 google domains I followed the instructions on this page Create DNS records at Google Domains for Microsoft