|
| 1 | +--- |
| 2 | +title: Troubleshoot 403 error when adding a user to a group using Microsoft Graph API |
| 3 | +description: Provides solutions to 403 Authorization_RequestDenied error that occurs when you add a user to a group using Microsoft Graph API. |
| 4 | +ms.date: 04/21/2025 |
| 5 | +ms.service: entra-id |
| 6 | +ms.author: bachoang |
| 7 | +ms.custom: sap:Getting access denied errors (Authorization) |
| 8 | +--- |
| 9 | + |
| 10 | +# Troubleshoot 403 error when adding a user to a group using Microsoft Graph API |
| 11 | + |
| 12 | +This article provides guidance on troubleshooting a 403 Authorization_RequestDenied error when you try to add a user to a group using the Microsoft Graph API. |
| 13 | + |
| 14 | +## Symptoms |
| 15 | + |
| 16 | +When you try to add a user to a group using Microsoft Graph API, you receive the 403 error with the following error message: |
| 17 | + |
| 18 | +```output |
| 19 | +{ |
| 20 | +"error": { |
| 21 | +"code": "Authorization\_RequestDenied", |
| 22 | +"message": "Insufficient privileges to complete the operation.", |
| 23 | +"innerError": { |
| 24 | +"date": "2024-05-07T15:39:39", |
| 25 | +"request-id": "aa324f0f-b4a3-4af6-9c4f-996e195xxxx", |
| 26 | +"client-request-id": "aa324f0f-b4a3-4af6-9c4f-996e1959074e" |
| 27 | +} |
| 28 | +} |
| 29 | +} |
| 30 | +``` |
| 31 | + |
| 32 | +## Cause |
| 33 | + |
| 34 | +This issue might occur if the group you tried to add the use to can't be managed by Microsoft Graph. Microsoft Graph only supports Microsoft 365 groups and Security groups. |
| 35 | + |
| 36 | +For the Microsoft Graph supported group types, see [Working with groups in Microsoft Graph](/graph/api/resources/groups-overview?view=graph-rest-1.0&tabs=http#group-types-in-microsoft-entra-id-and-microsoft-graph) |
| 37 | + |
| 38 | +## Solution |
| 39 | + |
| 40 | +### Step 1: Check the group type |
| 41 | + |
| 42 | +Make sure that the group you are working is supported by Microsoft Graph. |
| 43 | + |
| 44 | +1. In Microsoft Graph, the type of group can be identified by the settings of its `groupTypes`, `mailEnabled`, and `securityEnabled` properties. Use the [Microsoft Graph Explorer](https://developer.microsoft.com/graph/graph-explorer) tool to check the group's attributes: |
| 45 | + |
| 46 | + ```http |
| 47 | + https://graph.microsoft.com/v1.0/groups/<Group Object ID>?$select=displayName,groupTypes,mailEnabled,securityEnable |
| 48 | + ``` |
| 49 | +
|
| 50 | + Example response: |
| 51 | +
|
| 52 | + ```output |
| 53 | + { |
| 54 | + "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#groups(displayName,groupTypes,mailEnabled,securityEnabled)/$entity", |
| 55 | + "displayName": "Test group A", |
| 56 | + "groupTypes": [], |
| 57 | + "mailEnabled": true, |
| 58 | + "securityEnabled": false |
| 59 | + } |
| 60 | + |
| 61 | + ``` |
| 62 | + |
| 63 | +2. Review the following table to verify if the group type is supported by Microsoft Graph API. In the example response, the "Test group A" group is a security group. For more information, see [Working with groups in Microsoft Graph](/graph/api/resources/groups-overview?view=graph-rest-1.0&tabs=http#group-types-in-microsoft-entra-id-and-microsoft-graph). |
| 64 | + |
| 65 | + | Type |groupTypes | mailEnabled | securityEnabled | Created and managed via the groups APIs | |
| 66 | + |--|--|--|--|--| |
| 67 | + | [Microsoft 365 groups](#microsoft-365-groups) | `["Unified"]` | `true` | `true` or `false` | Yes | |
| 68 | + | [Security groups](#security-groups-and-mail-enabled-security-groups) | `[]` | `false` | `true` | Yes | |
| 69 | + | [Mail-enabled security groups](#security-groups-and-mail-enabled-security-groups) | `[]` | `true` | `true` | No; read-only through Microsoft Graph | |
| 70 | + | Distribution groups | `[]` | `true` | `false` | No; read-only through Microsoft Graph | |
| 71 | + |
| 72 | +> [!NOTE] |
| 73 | +> - Group type cannot be changed after creation. For more information, see [Edit group settings](/entra/fundamentals/how-to-manage-groups#edit-group-settings). |
| 74 | +> - Dynamic groups (groupTypes contains "DynamicMembership") cannot have their membership managed via Microsoft Graph. |
| 75 | +
|
| 76 | +### Step 2: Verify required permissions |
| 77 | + |
| 78 | +Different group member types require specific permissions. For user-type membership, ensure that the application or account performing the operation has the `GroupMember.ReadWrite.All` permission. |
| 79 | + |
| 80 | +Refer to the [Add members documentation](https://learn.microsoft.com/en-us/graph/api/group-post-members?view=graph-rest-1.0&tabs=http) for detailed permission requirements. |
| 81 | + |
| 82 | +### Step 3: Check if the group is a role-assignable group |
| 83 | + |
| 84 | +1. Role-assignable groups require additional permissions to manage their members. You can confirm if the group is role-assignable using Azure Portal or Microsoft Graph Explorer: |
| 85 | + |
| 86 | + **Azure Portal** |
| 87 | + |
| 88 | + 1. In the [Azure portal](https://portal.azure.com), go to **Microsoft Entra ID**, select **Groups**, and then select **All groups**. |
| 89 | + 1. Locate the group that you are working on, select **Properties**. Review the **Microsoft Entra role can be assigned to the group** option. |
| 90 | + |
| 91 | + **Microsoft Graph Explorer:** |
| 92 | + |
| 93 | + Perform the following query and check the `isAssignableToRoles` value. |
| 94 | + |
| 95 | + ```http |
| 96 | + GET https://graph.microsoft.com/v1.0/groups/<group object="" id="">?$select=displayName,groupTypes,mailEnabled,securityEnabled,isAssignableToRole |
| 97 | + ``` |
| 98 | + Example response: |
| 99 | +
|
| 100 | + ```output |
| 101 | + { |
| 102 | + "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#groups(displayName,groupTypes,mailEnabled,securityEnabled,isAssignableToRole)/$entity", |
| 103 | + "displayName": "Test group B", |
| 104 | + "groupTypes": [], |
| 105 | + "mailEnabled": false, |
| 106 | + "securityEnabled": true, |
| 107 | + "isAssignableToRole": true |
| 108 | + } |
| 109 | + ``` |
| 110 | + |
| 111 | +2. If the group is role-assignable, you need the `RoleManagement.ReadWrite.Directory` permission in addition to `GroupMember.ReadWrite.All`. Fore more information, see [Add members documentation](/graph/api/group-post-members?view=graph-rest-1.0&tabs=http#permissions). |
| 112 | +
|
| 113 | +[!INCLUDE [Azure Help Support](../../../includes/azure-help-support.md)] |
0 commit comments