Search code examples
azurepowershellazure-active-directorypowershell-2.0

New-AzureADApplicationPasswordCredential throwing Authorization_RequestDenied

Trying to create a new client secret using powershell script. while executing New-AzureADApplicationPasswordCredential from powershell ISE, getting below error:

New-AzureADApplicationPasswordCredential : Error occurred while executing SetApplication Code: Authorization_RequestDenied Message: Insufficient privileges to complete the operation. RequestId: 1234567-abcd-1234-7890-1234567890 DateTimeStamp: Mon, 12 Dec 2022 05:21:54 GMT HttpStatusCode: Forbidden HttpStatusDescription: Forbidden HttpResponseStatus: Completed

Attached image has the API permissions given for the SP used to authenticate to AD. The SP has read/write access on AD graph and MS Graph and has Admin consent on org as well.

enter image description here

Solution

  • I tried in my environment and got below results:

    Initially I tried the same command and got same error.

    Console:

    enter image description here

    Make sure the User or service principal with whom you are trying to login into azure has at least contributor role or owner role at subscription level.

    Go to portal -> Subscription -> Access control(IAM) -> Add role assignments ->Add Contributor or Owner to your user or SP.

    enter image description here

    Also, make sure User or SP has Azure AD role of at least Application Administrator.

    Go to portal -> Azure-Active-Directory -> Roles and Administrators ->Application Administrator -> Add the role to your User or SP.

    enter image description here

    enter image description here

    enter image description here

    After Assigning both roles in my environment, I got the Client-Secret successfully.

    Console:

    enter image description here