Skip to content

update-mguser -UserId testll@domainname.com -PasswordProfile $PasswordProfile: Insuffient privileges #1382

Description

@rtienhoven

Hi,

If i connect with Connect-MGGraph by signing in as my global Administrator with the below commands:
connect-mggraph -ContextScope Process -scopes "Directory.ReadWrite.All","User.ReadWrite.All","Directory.AccessAsUser.All"
And I execute:

$PasswordProfile = @{
  Password = 'ThisIsAPassword2!'
  }
update-mguser -UserId testll@domainname.com -PasswordProfile $PasswordProfile -PasswordPolicies "DisableStrongPassword" 

This works as expected. If I connect based on a certificate:

Connect-MgGraph -ClientID xx -TenantId xx -CertificateThumbprint xx
And run the update-mguser command (with passowrdprofile), I get the below error:
update-mguser : Insufficient privileges to complete the operation.

Other thing with update-mguser are working fine (change displayname for example), but changing the passwordprofile is the issue.
I've readed that you need the Directory.AccessAsUser.All permission. But this permission is only available in the delegated context and not in the applicationcontext. How can I reset the password of a user if I use connect-mggraph with a certificate?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions