使用 Microsoft Graph 创建用户

Question

Can anyone please tell me how do I create a user using Microsoft graph ? It's very confusing with regards to permission and stuff

I do have few questions in mind.

1. Where will the user be created by calling create user API in graph ? Is it in Azure AD or somewhere else ?

2. I tried calling create user api by passing json and required headers, below is the error I get

3. Where exactly do I need to set the permission, I have already added permissions in the Application Registration Portal

But when API is executed it shows that I don't have enough permission.

FYI, I have registered the app using the same email id that I am using to test the APIs here https://developer.microsoft.com/en-us/graph/graph-explorer#

If I am not the admin, where exactly do I need to set or request for it ?

Answer 1

In order to create a User via Microsoft Graph, you need to request either Directory.ReadWrite.All or Directory.AccessAsUser.All permission.

Important : Directory.ReadWrite.All and Directory.AccessAsUser.All both require Admin Consent before you can use them. If you're using Graph Explorer then the URI you need to provide your tenant Admin will be generated for you. If you're doing this in your own application, you'll need to construct an Admin Consent URI yourself. You can find more details on this at v2 Endpoint & Admin Consent .

Once you have the proper permissions configured (and consented), you'll want to POST the following JSON body/payload to https://graph.microsoft.com/v1.0/users :

{
  "accountEnabled": true,
  "displayName": "displayName-value",
  "mailNickname": "mailNickname-value",
  "userPrincipalName": "upn-value@tenant-name.onmicrosoft.com",
  "passwordProfile" : {
    "forceChangePasswordNextSignIn": true,
    "password": "password-value"
  }
}

This will create a user with a temporary password. The user will be asked to set a new password as after as they authenticate for the first time.

Answer 2

Where will the user be created by calling create user API in graph ? Is it in Azure AD or somewhere else ?

Yes, the user created is in the Azure AD.

I tried calling create user api by passing json and required headers, below is the error I get

For your error, have you added the request body like the following, and this required admin:

Where exactly do I need to set the permission, I have already added permissions in the Application Registration Portal

The required permissions to create application:

For the details, please read here .