You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# Troubleshoot 403 error when adding a user to a group using Microsoft Graph API
10
+
# Troubleshoot 403 error when adding a user to a group by using Microsoft Graph API
11
11
12
-
This article provides guidance on troubleshooting a 403 Authorization_RequestDenied error when you try to add a user to a group using the Microsoft Graph API.
12
+
This article provides guidance for troubleshooting a "403 Authorization_RequestDenied" error that occurs when you try to add a user to a group by using the Microsoft Graph API.
13
13
14
14
## Symptoms
15
15
16
-
When you try to add a user to a group using Microsoft Graph API, you receive the 403 error with the following error message:
16
+
When you try to add a user to a group by using Microsoft Graph API, you receive the following "403" error message:
17
17
18
18
```output
19
19
{
@@ -31,15 +31,15 @@ When you try to add a user to a group using Microsoft Graph API, you receive the
31
31
32
32
## Cause
33
33
34
-
This issue might occur if the group you tried to add the user to can't be managed by Microsoft Graph. Microsoft Graph only supports Microsoft 365 groups and Security groups.
34
+
This issue occurs if the group that you tried to add the user to can't be managed by Microsoft Graph. Microsoft Graph supports only Microsoft 365 groups and Security groups.
35
35
36
36
## Solution
37
37
38
38
### Step 1: Check the group type
39
39
40
40
Make sure that the group you trying to modify is supported by Microsoft Graph.
41
41
42
-
1. In Microsoft Graph, the type of group can be identified by the settings of its `groupTypes`, `mailEnabled`, and `securityEnabled` properties. Use the [Microsoft Graph Explorer](https://developer.microsoft.com/graph/graph-explorer) to check the group's attributes:
42
+
1. In Microsoft Graph, the group type can be determined by the settings of its `groupTypes`, `mailEnabled`, and `securityEnabled` properties. Use the [Microsoft Graph Explorer](https://developer.microsoft.com/graph/graph-explorer) to check the group's attributes:
@@ -58,7 +58,7 @@ Make sure that the group you trying to modify is supported by Microsoft Graph.
58
58
59
59
```
60
60
61
-
2. Review the following table to verify if the group type is supported by Microsoft Graph API. In the example response, the "Test group A" group is a Distribution group that cannot be supported by Microsoft Graph. For more information, see [Working with groups in Microsoft Graph](/graph/api/resources/groups-overview).
61
+
2. Review the following table to verify that the group type is supported by Microsoft Graph API. In the example response, the "Test group A" group is a Distribution group that can't be supported by Microsoft Graph. For more information, see [Working with groups in Microsoft Graph](/graph/api/resources/groups-overview).
62
62
63
63
| Type |groupTypes | mailEnabled | securityEnabled | Can be managed by using Microsoft Graph APIs |
64
64
|--|--|--|--|--|
@@ -69,26 +69,26 @@ Make sure that the group you trying to modify is supported by Microsoft Graph.
69
69
70
70
> [!NOTE]
71
71
> - Group type can't be changed after creation. For more information, see [Edit group settings](/entra/fundamentals/how-to-manage-groups#edit-group-settings).
72
-
> -Dynamic groups (groupTypes contains "DynamicMembership") can't have their membership managed via Microsoft Graph.
72
+
> -The membership of a dynamic group (groupTypes contains "DynamicMembership") can't be managed through Microsoft Graph.
73
73
74
74
### Step 2: Verify required permissions
75
75
76
-
Different group member types require specific permissions. For user-type membership, ensure that the application or account performing the operation has the `GroupMember.ReadWrite.All` permission.
76
+
Different group member types require specific permissions. For user-type membership, make sure that the application or account that performs the operation has the `GroupMember.ReadWrite.All` permission.
77
77
78
78
For detailed permission requirements, see [Add members documentation](/graph/api/group-post-members).
79
79
80
-
### Step 3: Check if the group is a role-assignable group
80
+
### Step 3: Check whether the group is a role-assignable group
81
81
82
-
1. Role-assignable groups require extra permissions to manage their members. You can confirm if the group is role-assignable by using Azure portal or Microsoft Graph Explorer:
82
+
1. Role-assignable groups require extra permissions to manage their members. You can verify that the group is role-assignable by using Azure portal or Microsoft Graph Explorer:
83
83
84
84
**Azure portal**
85
85
86
86
1. In the [Azure portal](https://portal.azure.com), go to **Microsoft Entra ID**, select **Groups**, and then select **All groups**.
87
-
1. Locate the target group, select **Properties**. Check if the **Microsoft Entra role can be assigned to the group**setting is set to **Yes**,
87
+
1. Locate the target group, select **Properties**, and then check whether **Microsoft Entra role can be assigned to the group** is set to **Yes**.
88
88
89
89
**Microsoft Graph Explorer**
90
90
91
-
Run the following request and check the `isAssignableToRoles` value.
91
+
To check the `isAssignableToRoles` value, run the following request:
92
92
93
93
```http
94
94
GET https://graph.microsoft.com/v1.0/groups/<group object="" id="">?$select=displayName,groupTypes,mailEnabled,securityEnabled,isAssignableToRole
@@ -108,4 +108,4 @@ For detailed permission requirements, see [Add members documentation](/graph/api
108
108
109
109
2. If the group is role-assignable, you need the `RoleManagement.ReadWrite.Directory` permission in addition to `GroupMember.ReadWrite.All`. For more information, see [Add members documentation](/graph/api/group-post-members).
110
110
111
-
[!INCLUDE [Azure Help Support](../../../includes/azure-help-support.md)]
111
+
[!INCLUDE [Azure Help Support](../../../includes/azure-help-support.md)]
0 commit comments