通过Azure AD中的API创建用户

Question

GOAL : Create users in Azure Active Directory using our Global Admin account from an API.

PROBLEM : Every single way I try, I get "unauthorized".

WHAT I'VE TRIED:

• I've been focusing mostly on this: https://graph.microsoft.com/v1.0/invitations
• I've tried as outlined here
• the "Authorization Bearer {token}" is problematic -- I can't seem to properly retrieve tokens, using any of the built URLs recommended (ie, combining ClientID & TenantID in the URL.)
• I've tried the relevant portions of this , including creating the app, setting permissions on the app, trying both Web API and Native. I'm able to get a code back, but using it always comes back with Unauthorized.
  • As an aside, I am using Nintex to run this web service, as it is part of my workflow. Typically, web services don't give me issues. So, this sucks.

I'm missing something, here. Any thoughts or direction?

UPDATE: Removed the word "method" - bad choice of phrasing.

Answer 1

If you want to use Microsoft Graph explorer to create user as the global admin, you could use POST https://graph.microsoft.com/v1.0/users , and the required permission is:

Permissions

For the details, you could read Create user .

Answer 2

Global admin runs as a user by default. To grant access to Active Directory, you need to elevate permissions in the portal .

I'm not convinced you have the permissions to create the user, and that's why I think you're getting the error.

Also, try and avoid using Global Admin. Create a Service Principal and provide more granular permissions.