Skip to content
Browse

/errors/microsoft-graph/insufficient-privileges-to-complete-the-operation

Microsoft Graph PowerShell: Insufficient privileges to complete the operation (Authorization_RequestDenied)

The commands on this page have not been executed by our verification runner yet.updated
tool
Microsoft Graph PowerShell
versions
Microsoft.Graph 2.x
os
windows, linux, macos

Insufficient privileges to complete the operation. (error code Authorization_RequestDenied, HTTP 403) is returned by Microsoft Graph, not by PowerShell: the request reached Graph, but the token is not allowed to do what you asked. Two things must both allow the call:

  1. Permission in the token: the scope you requested with Connect-MgGraph -Scopes (delegated) or the application permission granted to the app (app-only).
  2. For delegated access, the user's own rights: the signed-in user needs an Entra role that allows the operation. A scope never gives a user more rights than they already have.

Check the token

powershell
Get-MgContext | Select-Object AuthType, Account, ClientId, @{n='Scopes'; e={$_.Scopes -join ', '}}

Then look up what the cmdlet needs:

powershell
Find-MgGraphCommand -Command Update-MgUser |
  Select-Object -First 1 -ExpandProperty Permissions |
  Format-Table Name, PermissionType, IsAdmin

If the scope is missing, reconnect with it:

powershell
Connect-MgGraph -Scopes "User.ReadWrite.All"

The scope is there and it still fails

For delegated sessions the answer is usually the user's role. Typical examples:

OperationNeeds (delegated)
Create, update or delete normal usersUser.ReadWrite.All scope + User Administrator role (or higher)
Reset passwords of administratorsA role that can manage that administrator, for example Privileged Authentication Administrator
Manage group membershipGroup.ReadWrite.All or GroupMember.ReadWrite.All scope + Groups Administrator role, or being a group owner
Assign licensesUser.ReadWrite.All or LicenseAssignment.ReadWrite.All scope + License Administrator or User Administrator role

For app-only sessions (AuthType is AppOnly), the application permission must be granted with admin consent in the app registration (API permissions > Grant admin consent). Some operations, such as changing passwords or properties of privileged users, also need the app's service principal to hold an Entra role. Reconnect after any change: existing tokens keep the old permissions.

See Graph permission vs Entra role for how the two layers combine.

Sources

Related pages

commands · microsoft-graphConnect-MgGraph -Scopes: which permissions to request in Microsoft Graph PowerShellConnect-MgGraph -Scopes requests delegated Graph permissions such as User.Read.All. Find the scope a cmdlet needs with Find-MgGraphCommand; app-only differs.compare · entra-idMicrosoft Graph permission vs Microsoft Entra role: delegated scopes, app roles and admin rolesA Graph permission says what an app may call; an Entra role says what a user or service principal may do. Delegated access needs both; app-only needs app roles.commands · microsoft-graphGet-MgContext: check the Microsoft Graph PowerShell connection, account, tenant and scopesGet-MgContext shows the account, tenant, auth type and scopes of the current Microsoft Graph PowerShell session, and returns nothing when you are not connected.