minimal application permission to delete a group using MS Graph

Question

I can delete and update Groups using the MS Graph API just fine. But when I try to remove one, I'm consistently getting this:

Authorization_RequestDenied - Insufficient privileges to complete the operation

Looking through the MS documentation, they say in an app-only scenario, I need this:

For app-only scenarios, the calling app must be the owner of the group or be assigned the RoleManagement.ReadWrite.Directory application permission or be assigned the Global Administrator or Privileged Role Administrator Azure AD role.

So, I assigned the RoleManagement.ReadWrite.Directory permission to my app registration, and granted admin consent. Waited 1 Microsoft, then tried again only to get the same error. Sure, I could just make my app Global Admin, but that ain't going to fly anywhere but on a dev environment. (note - I also have Group.ReadWrite.All - using it to create and update groups) So, what am I missing here? I'm open to trying to setting my app registration as owner.. but the owner examples in the documentation only mentions users..

Answer 1

I created one role-assignable group named RAgroup like below:

Now, I registered one Azure AD application and granted below API permissions:

I generated access token using client credentials flow via Postman with below parameters:

POST https://login.microsoftonline.com/tenantID/oauth2/v2.0/token
grant_type:client_credentials
client_id: appID
client_secret: secret 
scope: https://graph.microsoft.com/.default

Response:

When I ran below graph query to delete that group, I got same error as you:

DELETE https://graph.microsoft.com/v1.0/groups/<groupID>

Response:

Note that, Group.ReadWrite.All permission is required to delete groups. But if the group is role assignable, additional permission is required as mentioned in this MS Doc

To resolve the error, I assigned application as owner of the group like below:

After assigning application as group owner, it will be displayed like this after few minutes:

When I ran below graph query by generating token again, I got below response:

DELETE https://graph.microsoft.com/v1.0/groups/<groupID>

Response:

To confirm that, I checked the same in Portal by refreshing page where group deleted successfully like below:

In my case, assigning RoleManagement.ReadWrite.Directory permission of Application type also worked.

After adding above permission, generate the token again and decode it by pasting in jwt.ms to check permissions: