Search code examples
powershellazure-active-directoryazure-functions

Error occurred while executing GetUsers Code: Authorization_RequestDenied Message: Insufficient privileges to complete the operation

I try to get users from AAD by an Azure Function (PowerShell) with managed identity.

This is my code:

Import-Module AzureAD -UseWindowsPowerShell
Connect-AzAccount -identity
$context = [Microsoft.Azure.Commands.Common.Authentication.Abstractions.AzureRmProfileProvider]::Instance.Profile.DefaultContext
$graphToken = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate($context.Account, $context.Environment, $context.Tenant.Id.ToString(), $null, [Microsoft.Azure.Commands.Common.Authentication.ShowDialog]::Never, $null, "https://graph.microsoft.com").AccessToken
$aadToken = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate($context.Account, $context.Environment, $context.Tenant.Id.ToString(), $null, [Microsoft.Azure.Commands.Common.Authentication.ShowDialog]::Never, $null, "https://graph.windows.net").AccessToken
$body = "Hi I'm $($context.Account.Id)"
Connect-AzureAD -AadAccessToken $aadToken -AccountId $context.Account.Id -TenantId $context.tenant.id
$allUsers = Get-AzureADUser -All $True

I give my managed identity this permissions:

enter image description here

This is the error:

Error occurred while executing GetUsers Code: Authorization_RequestDenied Message: Insufficient privileges to complete the operation

Do I miss some permissions to read users from AAD?

AAD accestoken

Solution

  • Initially I got the same error:

    enter image description here

    I assigned below permissions to the managed identity:

    enter image description here

    The GitHub blog you are referring states that you have to assign User Administrator role to the managed identity.

    Hence to resolve the error, assign active User Administrator role to the managed identity:

    enter image description here

    Now, when I executed the same script, I got the list of users successfully:

    using namespace System.Net
# Input bindings are passed in via param block.
param($Request, $TriggerMetadata)
Import-Module AzureAD -UseWindowsPowerShell

Connect-AzAccount -Identity
$context = [Microsoft.Azure.Commands.Common.Authentication.Abstractions.AzureRmProfileProvider]::Instance.Profile.DefaultContext
$graphToken = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate($context.Account, $context.Environment, $context.Tenant.Id.ToString(), $null, [Microsoft.Azure.Commands.Common.Authentication.ShowDialog]::Never, $null, "https://graph.microsoft.com").AccessToken
$aadToken = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate($context.Account, $context.Environment, $context.Tenant.Id.ToString(), $null, [Microsoft.Azure.Commands.Common.Authentication.ShowDialog]::Never, $null, "https://graph.windows.net").AccessToken
$body = "Hi I'm $($context.Account.Id)"

Connect-AzureAD -AadAccessToken $aadToken -AccountId $context.Account.Id -TenantId $context.tenant.id
$allUsers = Get-AzureADUser -All $True
$allUsers

    enter image description here

    You can also modify the script to display the output in table format:

    using namespace System.Net
# Input bindings are passed in via param block.
param($Request, $TriggerMetadata)
Import-Module AzureAD -UseWindowsPowerShell

Connect-AzAccount -Identity
$context = [Microsoft.Azure.Commands.Common.Authentication.Abstractions.AzureRmProfileProvider]::Instance.Profile.DefaultContext
$graphToken = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate($context.Account, $context.Environment, $context.Tenant.Id.ToString(), $null, [Microsoft.Azure.Commands.Common.Authentication.ShowDialog]::Never, $null, "https://graph.microsoft.com").AccessToken
$aadToken = [Microsoft.Azure.Commands.Common.Authentication.AzureSession]::Instance.AuthenticationFactory.Authenticate($context.Account, $context.Environment, $context.Tenant.Id.ToString(), $null, [Microsoft.Azure.Commands.Common.Authentication.ShowDialog]::Never, $null, "https://graph.windows.net").AccessToken
$body = "Hi I'm $($context.Account.Id)"
Connect-AzureAD -AadAccessToken $aadToken -AccountId $context.Account.Id -TenantId $context.tenant.id

$allUsers = Get-AzureADUser -All $True
$allUsers | Format-Table -Property ObjectId, DisplayName, UserPrincipalName
$tableOutput = $allUsers | Format-Table -Property ObjectId, DisplayName, UserPrincipalName | Out-String
$tableOutput

    enter image description here

    If still the issue persists, try this command Connect-AzAccount -Identity -AccountId XXX (Pass the Application ID of the identity)