Can't set hideFromAddressLists in Logic Apps call to Graph API

Question

I have a Logic App that is calling the Graph API to create lots of O365 Groups. For the creation, I am using Application permissions with a registered Azure app which works great.

However, I am now trying to hide O365 groups from the GAL.
I need to set these parameters:

{
  "hideFromAddressLists": true,
  "hideFromOutlookClients": true
}

I am having the same issue described here. But I can't figure out how to call the Graph API on behalf of a user, with Delegated permissions. I've tried setting up an Azure Managed Identity and setting it's permissions as per these instructions, but I am getting error:

"code": "ErrorGroupsAccessDenied"    
"message": "User does not have permissions to execute this action.",

Can anyone help?

These are the App permissions I have set, but I am still getting "ErrorGroupsAccessDenied" "User does not have permissions to execute this action."

Answer 1

As your mentioned it requires to be called with delegated permission, so you can't get the access token just by MSI. According to the page you provided about MSI, it seems just use the service principal to verify the permissions. It still use application permission but not delegated permission. So please refer to the steps below to get the access token and then request the graph api.

1. Create an "HTTP" action to get the access token(we need to use username/password grant flow in this http request).

2. Use "Parse JSON" action to parse the response data from the HTTP action above.

3. Request the graph api to update the group(with the access token from "Parse JSON" action).

Please notice there is a space between "Bearer" and "access_token".