"Insufficient privileges to complete the operation" on EmployeeExperience.LearningProviders.GetAsync()

Question

I need to get (and eventually create) the LearningProvider(s) in a certain Azure Tenant. The creation is done by this call in C#:

   var options = new OnBehalfOfCredentialOptions
   {
       AuthorityHost = AzureAuthorityHosts.AzurePublicCloud
   };
   var onBehalfOfCredential = new OnBehalfOfCredential(tid, AppClientId, AppClientSecret, jwt, options);
   var client = new GraphServiceClient(onBehalfOfCredential, scopes);
   var learningProviders = await client.EmployeeExperience.LearningProviders.GetAsync();

Where:

• tid: Logged user Tenant ID
• AppClientId/Secret: The registered App Id/Secret
• jwt: The logget user JWT token

The error which returns when I try to get the LearningProviders is:

Microsoft.Graph.Models.ODataErrors.MainError 
Code: forbidden 
Error: Insufficient privileges to complete the operation.

I have the following permissions in the register app:

Answer 1

The error "Forbidden" usually occurs if the signed-in user does not have required permissions or roles to perform the operation.

Initially, I too got same error when I ran your code in my environment with same permissions:

To work with learning providers, logged in user need either Global Admin or Knowledge Admin role, along with LearningProvider.ReadWrite permission of Delegated type.

In my case, I assigned Knowledge Administrator role to the logged in user like this:

When I ran the code again now after assigning above role, I got the response successfully with learning provider details like this:

using Azure.Identity;
using Microsoft.Graph;
using Microsoft.Graph.Models.ODataErrors;

var scopes = new[] { "https://graph.microsoft.com/.default" };

var tid = "xxxxxxx";
var AppClientId = "xxxxxxx";
var AppClientSecret = "xxxxxxx";

var options = new OnBehalfOfCredentialOptions
{
    AuthorityHost = AzureAuthorityHosts.AzurePublicCloud,
};

var jwt = "xxxxxxxxxxx";

var onBehalfOfCredential = new OnBehalfOfCredential(
    tid, AppClientId, AppClientSecret, jwt, options);

var client = new GraphServiceClient(onBehalfOfCredential, scopes);
try
{
    var learningProviders = await client.EmployeeExperience.LearningProviders.GetAsync();
    foreach (var provider in learningProviders.Value)
    {
        Console.WriteLine($"Learning Provider ID: {provider.Id}");
        Console.WriteLine($"Learning Provider Name: {provider.DisplayName}");
        Console.WriteLine($"Login Web Url: {provider.LoginWebUrl}");
        Console.WriteLine();
    }       
}

catch (ODataError odataError)
{
    Console.WriteLine($"Code: {odataError.Error.Code}");
    Console.WriteLine($"Error: {odataError.Error.Message}");
}

Response:

Reference: Permissions required to manage learningProvider - Microsoft Graph