0
218
ViewsDeleting an user in Azure AD through graph in Express API
I have an API through which I want to delete an user in Azure AD.
The API is registered, and has the following application scope to access graph:
- User.ReadWrite.All (Which according to the documentation should be enough)
Additionally, the API has the default roles that are assigned upon creation, that is:
- Attribute assignment administrator
- Attribute assignment reader
- Cloud application administrator
- Reports reader
^ Not sure if these matters though - Nonetheless, I'm not sure that I can assign any additional roles under the free tier.
Anyway, I'm calling graph as follows:
module.exports.deleteUserById = async (objectId) => {
const ccrRequest = {
scopes: ['https://graph.microsoft.com/.default'],
}
const accessToken = await cca.acquireTokenByClientCredential(ccrRequest)
const options = {
method: "DELETE",
headers: { 'Authorization': `Bearer ${accessToken.accessToken}`, 'Content-Type': "application/json" },
}
return await fetch(graphUsers() + `/${objectId}`, options)
}
The above should work, however when I'm attempting to delete any given user, the call returns an error:
code:'Authorization_RequestDenied' message:'Insufficient privileges to complete the operation.'
1 answers
Answer question0
You must have a Global administrator or User administrator role assignment to delete users in your organization. Global admins can delete any users including other admins. User administrators can delete any non-admin users, Helpdesk administrators and other User administrators. For more information, see Administrator role permissions in Azure AD
For more details refer this document
To assign particular role to users follow these steps
1) Sign in to the Azure portal or Azure AD admin center.
2) Select Azure Active Directory > Roles and administrators to see the list of all available roles.
3) Select a role to see its assignments. To help you find the role you need, use Add filters to filter the roles.
4) Select Add assignments and then select the users you want to assign to this role.
5) Select Add to assign the role.
For more details refer this document