Error "Insufficient privileges to complete the operation" in Powershell - Works ok on Graph Explorer though

Question

Hi,

I'm new to using graph and ran a query on the graph explorer which worked ok:

https://graph.microsoft.com/v1.0/groups/xxxxxxxxxxxxxxxx/membersWithLicenseErrors?$select=userPrincipalName

Now, I am trying to the equivalent command in powershell and it fails with this error:

PS C:\Users\User1> Connect-MgGraph
Welcome To Microsoft Graph!

PS C:\Users\User1> Get-MgGroupMemberWithLicenseError -GroupId xxxxxxxxxxxx
Get-MgGroupMemberWithLicenseError : Insufficient privileges to complete the operation.
At line:1 char:1

• Get-MgGroupMemberWithLicenseError -GroupId xxxxxxxx-ba65-4989-baa8-f1 ...
• ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
• CategoryInfo : InvalidOperation: ({ GroupId = a63...ndProperty = }:<>f__AnonymousType279) [Get-MgGroupMemberWithLicenseError_List4], RestException1
• FullyQualifiedErrorId : Authorization_RequestDenied,Microsoft.Graph.PowerShell.Cmdlets.GetMgGroupMemberWithLicenseError_List4

Answer 1

Hello.

You can check which permissions you are missing by this command:

PS> (Find-MgGraphCommand -Command get-MgPolicyAuthorizationPolicy).permissions Policy.Read.All
Policy.ReadWrite.Authorization

 

Now connect to M Graph by this command:

PS> Connect-Graph -scopes "Policy.Read.All"

Answer 2

Looks like you don't have group.Read.ALL permissions, could you please try to run below command and check your scopes, if you have the required permissions.

Get-MgContext | select -ExpandProperty Scopes

If you don't have the required permissions , kindly nun the below command to add the permission

Connect-MgGraph -Scopes "group.Read.All"

Hope this will help to fix your issue.

Thanks

Answer 3

Yes, seems like I don't have the access. I will confirm once I get the access.

Answer 4

Hello there,

This problem occurs because the user account that is being used to run the Azure PowerShell cmdlets does not have the correct administrator role.

To resolve this problem, use one of the following methods:

-Run the PowerShell cmdlets by using a user account that has the correct administrator role.
-Promote the problem user account to the correct administrator role.

For example, you may be required to have a global administrator role in the Azure Active Directory in order to run the cmdlets.

--------------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept it as an answer–

Answer 5

Tried running using global admin, still getting error

Get-MgSubscribedSku : Insufficient privileges to complete the operation.

Status: 403 (Forbidden)

ErrorCode: Authorization_RequestDenied