使用Graph API更改Azure AD B2C用户密码

Question

I'm trying to use the Sample Graph API app to change a user's password but I'm getting:

Error Calling the Graph API Response:

{
  "odata.error": {
    "code": "Authorization_RequestDenied",
    "message": {
      "lang": "en",
      "value": "Insufficient privileges to complete the operation."
    }
  }
}

Graph API Request:

PATCH /mytenant.onmicrosoft.com/users/some-guid?api-version=1.6 HTTP/1.1
client-request-id: ffd564d3-d716-480f-a66c-07b02b0e32ab
date-time-utc: 2017.08.10 03:04 PM

JSON File

{
    "passwordProfile": {
        "password": "Somepassword1$",
        "forceChangePasswordNextLogin": false
    }
}

I've tested updating the user's displayName and that works fine.

{
    "displayName": "Joe Consumer"
}

AD Application Permissions

I've configured my app permissions as described here.

Answer 1

Check out this article . Seems like it has the same symptoms.

Solution 1:

If you are receiving this error when you call the API that includes only read permissions, you have to set permissions in Azure Management Portal.

• Go to Azure Management Portal and click Active Directory.
• Select your custom AD directory.
• Click Applications and select your Application.
• Click CONFIGURE and scroll down to the section 'Permissions to other applications'.
• Provide required Application Permissions and Delegated Permissions for Windows Azure Active Directory.
• Finally save the changes.

Solution 2:

If you are receiving this error when you call the API that includes delete or reset password operations, that is because those operations require the Admin role of Company Administrator . As of now, you can only add this role via the Azure AD Powershell module .

1. Find the service principal using Get-MsolServicePrincipal –AppPrincipalId

    Get-MsolServicePrincipal | ft DisplayName, AppPrincipalId -AutoSize 

2. Use Add-MsolRoleMember to add it to Company Administrator role

    $clientIdApp = 'your-app-id' $webApp = Get-MsolServicePrincipal –AppPrincipalId $clientIdApp Add-MsolRoleMember -RoleName "Company Administrator" -RoleMemberType ServicePrincipal -RoleMemberObjectId $webApp.ObjectId 

To connect to your B2C tenant via PowerShell you will need a local admin account. This blog post should help with that, see "The Solution" section.

Answer 2

Try below settings, works for me.

Used the below JSON

 {
  "accountEnabled": true,
  "signInNames": [
    {
      "type": "emailAddress",
      "value": "kart.kala1@test.com"
    }
  ],
  "creationType": "LocalAccount",
  "displayName": "Joe Consumer",
  "mailNickname": "joec",
  "passwordProfile": {
    "password": "P@$$word!",
    "forceChangePasswordNextLogin": false
  },
  "passwordPolicies": "DisablePasswordExpiration",
  "givenName": "Joe",
}

Also make sure you assign the application the user account, administrator role which will allow it to delete users link here