Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

Insufficient privileges to complete the operation - groups with isAssignableToRole set to True

オープン
  • 何か問題がありますか？
#140 コメント 10 件 リアクション 6 件 担当者 1 名 GitHub で見る

@jason-dou がすでに取り組んでいます。

2024年6月13日 から。

評価

この issue はまだ評価されていません。

説明

bug graph-platform triaged

Bicep version
Run bicep --version via the Bicep CLI, az bicep version via the AZ CLI

PS: ~:bicep --version
Bicep CLI version 0.28.1 (ba1e9f8c1e)

PS: ~:az bicep version  
Bicep CLI version 0.28.1 (ba1e9f8c1e)

Resource and API version
Which Microsoft.Graph resource and API version has the issue?

Microsoft.Graph/[email protected]

Auth flow
Is the deployment interactive (e.g. with a signed in user) or automated (e.g. with an application)?

Both - ServicePrincipal and Signed in user

Deployment details
If it's related to deployment failures, please provide the deployment correlation id, Microsoft Graph client request id, and deployment timestamp if applicable.

{
  "status": "Failed",
  "error": {
    "code": "DeploymentFailed",
    "target": "/subscriptions/xxxx-xxxxx-xxxxx-xxxxx/providers/Microsoft.Resources/deployments/entraid-sec-groups-test",
    "message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.",
    "details": [
      {
        "code": "",
        "message": "{\"error\":{\"code\":\"Forbidden\",\"target\":\"/resources/role_tier1Analyst\",\"message\":\"Insufficient privileges to complete the operation. Graph client request id: 9335c582-d847-49e8-9079-3e4a89a5d2e0. Graph request timestamp: 2024-06-13T11:59:32Z.\"}}"
      }
    ]
  }
}

Describe the bug

For Microsoft.Graph/groups resource type when using the property isAssignableToRole set to true, which requires an additional permission for the signed in user/service principal fails even tough the permission is granted.

From the Groups doc: https://learn.microsoft.com/en-us/graph/templates/reference/groups?view=graph-bicep-1.0

Only callers in Global Administrator and Privileged Role Administrator roles can set this property. The caller must also be assigned the RoleManagement.ReadWrite.Directory permission to set this property or update the membership of such groups.

The service principal I'm using is granted the following Microsoft Graph permissions:

  • Directory.ReadWrite.All
  • Group.ReadWrite.All
  • RoleManagement.ReadWrite.Directory

It works fine to deploy a group without the property isAssignableToRole set to true. That would mean the permissions are in effect I would believe?

In addition to the Microsoft Graph permissions the service principal have the Entra ID role Privileged Role Administrator which is also a prerequisite.

To Reproduce

  1. Create ServicePrincipal with Microsoft graph application permissions: 'RoleManagement.ReadWrite.Directory', 'Group.ReadWrite.All', 'Directory.ReadWrite.All' (Remember Global Admin consent)
  2. Create a Microsoft.Graph/groups resource:
targetScope = 'subscription'

provider microsoftGraph

resource groupExample 'Microsoft.Graph/[email protected]' = {
  displayName: 'Example Group'
  description: 'Example Group'
  isAssignableToRole: true
  mailEnabled: false
  mailNickname: 'example-group'
  securityEnabled: true
  uniqueName: 'example-group'
}

az login --service-principal --username '1234' --password '1234' --tenant '1234'

az deployment sub create --name 'entraid-sec-groups-test' --template-file .\{filename}.bicep --location 'NorwayEast'

Additional context
Add any other context about the problem here. For example, what permissions does the identity have if it's a permission issue?

主要言語
TypeScript
スター
81
フォーク
15
平均マージ
1日 17時間
マージ済み PR（30日）
3

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

microsoftgraph/msgraph-bicep-types のほかの issue

microsoftgraph/msgraph-bicep-types の issue をすべて見る

似ている issue

TypeScript の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。