Skip to content

Commit b82973e

Browse files
genlingenlin
committed
add a new file
1 parent 3e09890 commit b82973e

2 files changed

Lines changed: 118 additions & 1 deletion

File tree

‎support/entra/entra-id/toc.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,9 @@
7878
href: app-integration/send-notification-details.md
7979
- name: Troubleshoot sign-in to apps
8080
items:
81+
- name: AADSTS7500514 - A supported type of SAML response was not found
82+
href: app-integration/error-code-aadsts7500514-supported-type-saml-response-not-found.md
83+
- name: Error AADSTS220501 - Unable to download Certificate Revocation List
8184
- name: Error code AADSTS50173 - The provided grant has expired due to it being revoked
8285
href: app-integration/error-code-aadsts50173-grant-expired-revoked.md
8386
- name: Error AADSTS220501 - Unable to download Certificate Revocation List
@@ -291,7 +294,8 @@
291294
href: users-groups-entra-apis/identity-of-calling-application-not-established.md
292295
- name: Add an owner to an application
293296
href: users-groups-entra-apis/add-owner-for-application-microsoft-graph.md
294-
297+
- name: 403 error when adding a user to a group
298+
href: users-groups-entra-apis/authorization-requestdenied-403-error-add-user-group.md
295299
- name: Microsoft Entra User Provisioning and Synchronization
296300
items:
297301
- name: User Sign-in or password Problems

‎support/entra/entra-id/users-groups-entra-apis/authorization-requestdenied-403-error-add-user-group.md‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
---
2+
title: Troubleshoot 403 error when adding a user to a group using Microsoft Graph API
3+
description: Provides solutions to 403 Authorization_RequestDenied error that occurs when you add a user to a group using Microsoft Graph API.
4+
ms.date: 04/21/2025
5+
ms.service: entra-id
6+
ms.author: bachoang
7+
ms.custom: sap:Getting access denied errors (Authorization)
8+
---
9+
10+
# Troubleshoot 403 error when adding a user to a group using Microsoft Graph API
11+
12+
This article provides guidance on troubleshooting a 403 Authorization_RequestDenied error when you try to add a user to a group using the Microsoft Graph API.
13+
14+
## Symptoms
15+
16+
When you try to add a user to a group using Microsoft Graph API, you receive the 403 error with the following error message:
17+
18+
```output
19+
{
20+
"error": {
21+
"code": "Authorization\_RequestDenied",
22+
"message": "Insufficient privileges to complete the operation.",
23+
"innerError": {
24+
"date": "2024-05-07T15:39:39",
25+
"request-id": "aa324f0f-b4a3-4af6-9c4f-996e195xxxx",
26+
"client-request-id": "aa324f0f-b4a3-4af6-9c4f-996e1959074e"
27+
}
28+
}
29+
}
30+
```
31+
32+
## Cause
33+
34+
This issue might occur if the group you tried to add the use to can't be managed by Microsoft Graph. Microsoft Graph only supports Microsoft 365 groups and Security groups.
35+
36+
For the Microsoft Graph supported group types, see [Working with groups in Microsoft Graph](/graph/api/resources/groups-overview?view=graph-rest-1.0&tabs=http#group-types-in-microsoft-entra-id-and-microsoft-graph)
37+
38+
## Solution
39+
40+
### Step 1: Check the group type
41+
42+
Make sure that the group you are working is supported by Microsoft Graph.
43+
44+
1. In Microsoft Graph, the type of group can be identified by the settings of its `groupTypes`, `mailEnabled`, and `securityEnabled` properties. Use the [Microsoft Graph Explorer](https://developer.microsoft.com/graph/graph-explorer) tool to check the group's attributes:
45+
46+
```http
47+
https://graph.microsoft.com/v1.0/groups/<Group Object ID>?$select=displayName,groupTypes,mailEnabled,securityEnable
48+
```
49+
50+
Example response:
51+
52+
```output
53+
{
54+
"@odata.context": "https://graph.microsoft.com/v1.0/$metadata#groups(displayName,groupTypes,mailEnabled,securityEnabled)/$entity",
55+
"displayName": "Test group A",
56+
"groupTypes": [],
57+
"mailEnabled": true,
58+
"securityEnabled": false
59+
}
60+
61+
```
62+
63+
2. Review the following table to verify if the group type is supported by Microsoft Graph API. In the example response, the "Test group A" group is a security group. For more information, see [Working with groups in Microsoft Graph](/graph/api/resources/groups-overview?view=graph-rest-1.0&tabs=http#group-types-in-microsoft-entra-id-and-microsoft-graph).
64+
65+
| Type |groupTypes | mailEnabled | securityEnabled | Created and managed via the groups APIs |
66+
|--|--|--|--|--|
67+
| [Microsoft 365 groups](#microsoft-365-groups) | `["Unified"]` | `true` | `true` or `false` | Yes |
68+
| [Security groups](#security-groups-and-mail-enabled-security-groups) | `[]` | `false` | `true` | Yes |
69+
| [Mail-enabled security groups](#security-groups-and-mail-enabled-security-groups) | `[]` | `true` | `true` | No; read-only through Microsoft Graph |
70+
| Distribution groups | `[]` | `true` | `false` | No; read-only through Microsoft Graph |
71+
72+
> [!NOTE]
73+
> - Group type cannot be changed after creation. For more information, see [Edit group settings](/entra/fundamentals/how-to-manage-groups#edit-group-settings).
74+
> - Dynamic groups (groupTypes contains "DynamicMembership") cannot have their membership managed via Microsoft Graph.
75+
76+
### Step 2: Verify required permissions
77+
78+
Different group member types require specific permissions. For user-type membership, ensure that the application or account performing the operation has the `GroupMember.ReadWrite.All` permission.
79+
80+
Refer to the [Add members documentation](https://learn.microsoft.com/en-us/graph/api/group-post-members?view=graph-rest-1.0&amp;tabs=http) for detailed permission requirements.
81+
82+
### Step 3: Check if the group is a role-assignable group
83+
84+
1. Role-assignable groups require additional permissions to manage their members. You can confirm if the group is role-assignable using Azure Portal or Microsoft Graph Explorer:
85+
86+
**Azure Portal**
87+
88+
1. In the [Azure portal](https://portal.azure.com), go to **Microsoft Entra ID**, select **Groups**, and then select **All groups**.
89+
1. Locate the group that you are working on, select **Properties**. Review the **Microsoft Entra role can be assigned to the group** option.
90+
91+
**Microsoft Graph Explorer:**
92+
93+
Perform the following query and check the `isAssignableToRoles` value.
94+
95+
```http
96+
GET https://graph.microsoft.com/v1.0/groups/<group object="" id="">?$select=displayName,groupTypes,mailEnabled,securityEnabled,isAssignableToRole
97+
```
98+
Example response:
99+
100+
```output
101+
{
102+
"@odata.context": "https://graph.microsoft.com/v1.0/$metadata#groups(displayName,groupTypes,mailEnabled,securityEnabled,isAssignableToRole)/$entity",
103+
"displayName": "Test group B",
104+
"groupTypes": [],
105+
"mailEnabled": false,
106+
"securityEnabled": true,
107+
"isAssignableToRole": true
108+
}
109+
```
110+
111+
2. If the group is role-assignable, you need the `RoleManagement.ReadWrite.Directory` permission in addition to `GroupMember.ReadWrite.All`. Fore more information, see [Add members documentation](/graph/api/group-post-members?view=graph-rest-1.0&amp;tabs=http#permissions).
112+
113+
[!INCLUDE [Azure Help Support](../../../includes/azure-help-support.md)]

0 commit comments

Comments
 (0)