Ms Graph - Disable User Account

Question

Hi,

I am writing a PowerShell script to disable Azure AD users that are not synced from on-premises.

As part of the script I am running a foreach loop to disable the users with the following command:

$params = @{  
    AccountEnabled = "false"  
            }  

Update-MgUser -UserId $User.Id -BodyParameter $params  

This worked for a load of guest users but it did not work for accounts which have admins roles assigned to them. I am getting the following error for these accounts:

"Update-MgUser : Insufficient privileges to complete the operation.
At line:3 char:9

• Update-MgUser -UserId $User.Id -BodyParameter $params
• ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
• CategoryInfo : InvalidOperation: ({ UserId = 59c8...softGraphUser }:<>f__AnonymousType552) [Update-MgUser_Update1], RestException1
• FullyQualifiedErrorId : Authorization_RequestDenied,Microsoft.Graph.PowerShell.Cmdlets.UpdateMgUser_Update1"

The connection into MS Graph is using an App Registration and Certificate for authentication. The app permissions included are the following:

Hopefully someone can help in locating the actual permissions required.

Answer 1

To update the accountEnabled property of admin users, you need to use delegate permissions. It's not possible to do it via application permissions. See for example this GitHub issue: https://github.com/microsoftgraph/microsoft-graph-docs/issues/14731

Answer 2

If anyone comes across this in the future, you need to include the scope "User.EnableDisableAccount.All" when starting a new session.

Answer 3

Hello Son-3712,

Since the question is related to scripting of Microsoft Graph I would recommend you to get in touch with the specific community for that product at:

https:// techcommunity.microsoft.com/t5/microsoft-graph/bd-p/OfficeGraph

This way, the community will be more experience and able to provide expert advice of your question.

------------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept as answer--