Skip to content

Commit 1094a46

Browse files
genlingenlin
authored
Merge pull request #8762 from genlin/main5502
AB#5502 Troubleshoot 403 error when adding a user to a group using Microsoft Graph API
2 parents c3ab53d + 92bd1d7 commit 1094a46

File tree

2 files changed

+113
-0
lines changed

2 files changed

+113
-0
lines changed

‎support/entra/entra-id/toc.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -283,6 +283,8 @@
283283
href: app-integration/graph-api-error-handling-invoke-restmethod.md
284284
- name: Troubleshoot Authorization RequestDenied error
285285
href: app-integration/troubleshoot-authorization-requestdenied-graph-api.md
286+
- name: 403 error when adding a user to a group
287+
href: users-groups-entra-apis/authorization-requestdenied-403-error-add-user-group.md
286288
- name: 404 error when managing objects
287289
href: app-integration/404-not-found-error-manage-objects-microsoft-graph.md
288290
- name: Use managed identities to call Graph APIs in VB.Net and C#

‎support/entra/entra-id/users-groups-entra-apis/authorization-requestdenied-403-error-add-user-group.md‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
---
2+
title: Troubleshoot Error 403 When Adding a User to a Group By Using Microsoft Graph API
3+
description: Provides solutions for the 403 Authorization_RequestDenied error that occurs when you add a user to a group by using Microsoft Graph API.
4+
ms.date: 04/21/2025
5+
ms.service: entra-id
6+
ms.author: bachoang
7+
ms.custom: sap:Getting access denied errors (Authorization)
8+
---
9+
10+
# Troubleshoot 403 error when adding a user to a group by using Microsoft Graph API
11+
12+
This article provides guidance for troubleshooting a "403 Authorization_RequestDenied" error that occurs when you try to add a user to a group by using the Microsoft Graph API.
13+
14+
## Symptoms
15+
16+
When you try to add a user to a group by using Microsoft Graph API, you receive the following "403" error message:
17+
18+
```output
19+
{
20+
"error": {
21+
"code": "Authorization_RequestDenied",
22+
"message": "Insufficient privileges to complete the operation.",
23+
"innerError": {
24+
"date": "2024-05-07T15:39:39",
25+
"request-id": "aa324f0f-b4a3-4af6-9c4f-996e195xxxx",
26+
"client-request-id": "aa324f0f-b4a3-4af6-9c4f-996e1959074e"
27+
}
28+
}
29+
}
30+
```
31+
32+
## Cause
33+
34+
This issue occurs if the group that you tried to add the user to can't be managed by Microsoft Graph. Microsoft Graph supports only Microsoft 365 groups and Security groups.
35+
36+
## Solution
37+
38+
### Step 1: Check the group type
39+
40+
Make sure that the group you trying to modify is supported by Microsoft Graph.
41+
42+
1. In Microsoft Graph, the group type can be determined by the settings of its `groupTypes`, `mailEnabled`, and `securityEnabled` properties. Use the [Microsoft Graph Explorer](https://developer.microsoft.com/graph/graph-explorer) to check the group's attributes:
43+
44+
```http
45+
https://graph.microsoft.com/v1.0/groups/<Group Object ID>?$select=displayName,groupTypes,mailEnabled,securityEnable
46+
```
47+
48+
Example response:
49+
50+
```output
51+
{
52+
"@odata.context": "https://graph.microsoft.com/v1.0/$metadata#groups(displayName,groupTypes,mailEnabled,securityEnabled)/$entity",
53+
"displayName": "Test group A",
54+
"groupTypes": [],
55+
"mailEnabled": true,
56+
"securityEnabled": false
57+
}
58+
59+
```
60+
61+
2. Review the following table to verify that the group type is supported by Microsoft Graph API. In the example response, the "Test group A" group is a Distribution group that can't be supported by Microsoft Graph. For more information, see [Working with groups in Microsoft Graph](/graph/api/resources/groups-overview).
62+
63+
| Type |groupTypes | mailEnabled | securityEnabled | Can be managed by using Microsoft Graph APIs |
64+
|--|--|--|--|--|
65+
| [Microsoft 365 groups](/graph/api/resources/groups-overview#microsoft-365-groups) | `["Unified"]` | `true` | `true` or `false` | Yes |
66+
| [Security groups](/graph/api/resources/groups-overview#security-groups-and-mail-enabled-security-groups) | `[]` | `false` | `true` | Yes |
67+
| [Mail-enabled security groups](/graph/api/resources/groups-overview#security-groups-and-mail-enabled-security-groups) | `[]` | `true` | `true` | No; read-only through Microsoft Graph |
68+
| Distribution groups | `[]` | `true` | `false` | No; read-only through Microsoft Graph |
69+
70+
> [!NOTE]
71+
> - Group type can't be changed after creation. For more information, see [Edit group settings](/entra/fundamentals/how-to-manage-groups#edit-group-settings).
72+
> - The membership of a dynamic group (**groupTypes** contains "DynamicMembership") can't be managed through Microsoft Graph.
73+
74+
### Step 2: Verify required permissions
75+
76+
Different group member types require specific permissions. For user-type membership, make sure that the application or account that performs the operation has the `GroupMember.ReadWrite.All` permission.
77+
78+
For detailed permission requirements, see [Add members documentation](/graph/api/group-post-members).
79+
80+
### Step 3: Check whether the group is a role-assignable group
81+
82+
1. Role-assignable groups require extra permissions to manage their members. You can verify that the group is role-assignable by using Azure portal or Microsoft Graph Explorer:
83+
84+
**Azure portal**
85+
86+
1. In the [Azure portal](https://portal.azure.com), go to **Microsoft Entra ID**, select **Groups**, and then select **All groups**.
87+
1. Locate the target group, select **Properties**, and then check whether **Microsoft Entra role can be assigned to the group** is set to **Yes**.
88+
89+
**Microsoft Graph Explorer**
90+
91+
To check the `isAssignableToRoles` value, run the following request:
92+
93+
```http
94+
GET https://graph.microsoft.com/v1.0/groups/<group object="" id="">?$select=displayName,groupTypes,mailEnabled,securityEnabled,isAssignableToRole
95+
```
96+
Example response:
97+
98+
```output
99+
{
100+
"@odata.context": "https://graph.microsoft.com/v1.0/$metadata#groups(displayName,groupTypes,mailEnabled,securityEnabled,isAssignableToRole)/$entity",
101+
"displayName": "Test group B",
102+
"groupTypes": [],
103+
"mailEnabled": false,
104+
"securityEnabled": true,
105+
"isAssignableToRole": true
106+
}
107+
```
108+
109+
2. If the group is role-assignable, you need the `RoleManagement.ReadWrite.Directory` permission in addition to `GroupMember.ReadWrite.All`. For more information, see [Add members documentation](/graph/api/group-post-members).
110+
111+
[!INCLUDE [Azure Help Support](../../../includes/azure-help-support.md)]

0 commit comments

Comments
 (0)