How To
Summary
The issue you're encountering with the 403 Forbidden error ("Authorization_RequestDenied: Insufficient privileges to complete the operation") when assigning the `User.Read.All` permission likely stems from the authentication token lacking the necessary delegated permissions for the PowerShell session.
The script assumes a basic connection via `Connect-MgGraph`, but this command uses default scopes that may not include the required permissions to perform app role assignments (like `New-MgServicePrincipalAppRoleAssignment`).
Objective
Key Reasons for the Error
- Token Scopes: The `New-MgServicePrincipalAppRoleAssignment` cmdlet requires specific Microsoft Graph delegated permissions in your session token, such as `AppRoleAssignment.ReadWrite.All` (to create app role assignments) and potentially `Directory.Read.All` (to query service principals). Without these, even a Global Admin account will encounter insufficient privileges.
- Admin Role vs. Token Permissions: Your Enterprise Admin (tenant owner/Global Admin) role allows you to consent to these permissions, but you must explicitly request them during connection. The error is isolated to `User.Read.All` because the prior assignment in the script (for `Purview.ProcessConversationMessages.All`) targets a different service principal, which might not trigger the same scope checks.
- No Article-Specific Issues Found: The steps in the article are correct, but they omit specifying scopes for `Connect-MgGraph`. This is a common oversight in Graph PowerShell scenarios, leading to 403 errors during administrative operations.
Environment
Azure
Steps
Possible Solution
1. Install/Update Modules (if needed):
- Ensure the Microsoft Graph PowerShell module is installed: `Install-Module Microsoft.Graph -Scope CurrentUser`.
- If using Azure Cloud Shell, it should already be available.
2. Connect with Required Scopes: (Usually works!)
- Before running the script, connect using explicit scopes:
```
Connect-MgGraph -Scopes "AppRoleAssignment.ReadWrite.All", "Directory.Read.All"
```
- Sign in with your Enterprise Admin account when prompted. As a Global Admin, you'll be able to consent to these scopes.
- If prompted for consent, approve it.
3. Run the Script:
- Proceed with the PowerShell script from the article, updating `$purviewFriendlyName` with your Microsoft Purview account's resource name.
- The full script (for reference):
```
$purviewFriendlyName = "YourPurviewResourceNameHere"
$purviewObjectId = (Get-MgServicePrincipal -Filter "displayName eq '$purviewFriendlyName'").id
$msGraphServicePrincipalId = (Get-MgServicePrincipal -Filter "AppId eq '00000003-0000-0000-c000-000000000000'").id
$purviewApiServicePrincipalId = (Get-MgServicePrincipal -Filter "AppId eq '9ec59623-ce40-4dc8-a635-ed0275b5d58a'").Id
Assign Purview.ProcessConversationMessages.All
$bodyParam = @{
"PrincipalId" = "{$purviewObjectId}"
"ResourceId" = "{$purviewApiServicePrincipalId}"
"AppRoleId" = "{a4543e1f-6e5d-4ec9-a54a-f3b8c156163f}"
}
New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId "{$purviewObjectId}" -BodyParameter $bodyParam
Assign User.Read.All (this should now succeed)
$bodyParam = @{
"PrincipalId" = "{$purviewObjectId}"
"ResourceId" = "{$msGraphServicePrincipalId}"
"AppRoleId" = "{df021288-bdef-4463-88db-98f22de89214}"
}
New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId "{$purviewObjectId}" -BodyParameter $bodyParam
```
4. Verify Assignments:
- After running, check the assignments:
```
Get-MgServicePrincipalAppRoleAssignedTo -ServicePrincipalId $purviewObjectId
```
- Look for the `User.Read.All` role (AppRoleId:?) assigned to the Microsoft Graph service principal.
Additional Information
Troubleshooting If It Persists
- Re-Authenticate: Disconnect (`Disconnect-MgGraph`) and reconnect with the scopes. Token caching can sometimes cause issues.
- Check Admin Consent: In the Azure portal, go to Microsoft Entra ID > Enterprise applications > Microsoft Graph PowerShell (or search for it), and ensure admin consent is granted for the scopes under Permissions.
- Role Confirmation: Confirm your account has the Global Administrator role in Microsoft Entra ID > Roles and administrators.
- Alternative Scopes: If needed, try broader scopes like `Directory.ReadWrite.All` (which implies `Directory.Read.All` and can handle assignments), but stick to least-privilege where possible.
- Error Details: Run the script with verbose output (`-Verbose`) to capture more details. If the error mentions a specific missing permission, add it to the `-Scopes` parameter.
- Known Edge Cases: If your tenant uses Conditional Access policies or Privileged Identity Management (PIM) for just-in-time roles, activate the role before connecting. Also, ensure no network proxies or firewalls are interfering with Graph API calls.
These actions should resolve the issue without needing changes to the Purview setup itself.
Document Location
Worldwide
Was this topic helpful?
Document Information
Modified date:
24 October 2025
UID
ibm17249179