Azure Python SDK - Interact with Azure AD

Question

I have a service principal account that I use to automate compute and resource management objects without issue. What I can't seem to interact with is the Azure AD side of the house. I am getting an

"azure.graphrbac.models.graph_error.GraphErrorException: Insufficient privileges to complete the operation"

I'm not sure where to go to add the correct privileges for this. Currently testing the following just to see if I can at least list users:

graph_credentials = ServicePrincipalCredentials(
client_id = CLIENT,
secret = KEY,
tenant = TENANT_ID,
resource = 'https://graph.windows.net'

graphrbac_client = GraphRbacManagementClient(graph_credentials, TENANT_ID)

for item in graphrbac_client.groups.list():
    print(item)

I've checked resources online and the SDK documentation, it looks like I'm doing it correctly. I'm sure it is something simple. I've also tried to use UserPassCredentials() but I get other errors. Don't want to use user creds for this anyway.

Permissions set:

Please edit your question and include the permissions assigned to this service principal. More than likely you didn't include the permission to list groups operation (which require admin privileges BTW). — Gaurav Mantri
– Gaurav Mantri, Commented Oct 7, 2019 at 1:12

Joy Wang · Accepted Answer · 2019-10-07 02:01:37Z

2

I suppose you have not granted the API permission to your AD App.

Navigate to your AD App in the portal -> API permissions -> grant the Azure Active Directory Graph with application permission(e.g. Directory.Read.All ), after adding permission, click Grant consent button at last.

Then I test it on my side, it works fine.

edited Oct 7, 2019 at 2:01

answered Oct 7, 2019 at 1:13

Joy Wang

42.4k3 gold badges38 silver badges64 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Nathan Over a year ago

That didn't seem to do it either. I'm trying to automate, and forgive me if I am getting terms crossed. I created an 'app' under 'App Registration'. This is where I'm getting the client id, tenant id, and key. If that's all the same then adding the Graph API just as you show results in the same error. The Tenant ID is just a long string, correct? In some docs I see it as an FQDN.

Joy Wang Over a year ago

@Nathan Please add the screenshot of the api permission of your application in the question.

Nathan Over a year ago

I added the permissions in the OP.

Nathan · Accepted Answer · 2019-10-07 23:47:41Z

1

I found out what the issue was. I was selecting the permissions under "Microsoft Graph" and that wasn't giving it the correct permissions. I didn't notice at the bottom of the API list was the Azure Active Directory Graph. I changed it there and it worked.

My question is now, this is listed as legacy. Should I be concerned with that? Is there a more proper way of doing this now?

answered Oct 7, 2019 at 23:47

Nathan

1675 silver badges18 bronze badges

1 Comment

Joy Wang Over a year ago

Don't worry, you can use the AAD Graph currently. The microsoft just recommend you to use Microsoft Graph, there is Microsoft Graph SDK now, but it does not support python. You can also call the MS Graph manually, learn.microsoft.com/en-us/graph/api/…

Collectives™ on Stack Overflow

Azure Python SDK - Interact with Azure AD

2 Answers 2

3 Comments

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related