使用Microsoft Graph API为Azure AD B2C用户分配组时遇权限不足错误

Hey Matthias, sorry to hear you're stuck with this permission error—let's walk through the most common fixes that might resolve your issue:

1. Confirm you're using the right permission type and scope #

When working with Azure AD B2C and Graph API for group member operations:

• If you're using an application permission (recommended for service-side/automated workflows), you need either GroupMember.ReadWrite.All or Group.ReadWrite.All. These permissions require admin consent to take effect.
• If you're using a delegated permission, the signed-in user must have a directory role (like Directory Writer or Global Administrator) that allows modifying group memberships. Delegated permissions are less reliable for B2C service operations since they depend on the user's role.

2. Double-check admin consent was granted #

Even if you added the correct permissions to your app registration, you need to explicitly grant admin consent for them to be included in your access token:

• Go to your Azure AD B2C tenant → App registrations → Select your app → API permissions
• Look for a "Granted for [your tenant]" label next to the Graph API permissions. If it's missing, click Grant admin consent for [tenant name] and confirm.

3. Decode your access token to verify permissions are present #

Use a JWT decoder tool to check the token's payload:

• For application permissions, look for the roles array—you should see the permission you configured (e.g., GroupMember.ReadWrite.All).
• For delegated permissions, check the scp field for the same permission.
  If the permission isn't listed here, your token wasn't issued with the right scope, so go back to your app registration and recheck the permission setup and consent.

4. Ensure you're using the correct Graph API endpoint and token issuer #

• Your request must target the standard Graph API endpoint: POST https://graph.microsoft.com/v1.0/groups/{group-id}/members/$ref
• Make sure your access token was issued from your B2C tenant's token endpoint (not a regular Azure AD tenant). For example, the token endpoint should look like https://your-b2c-tenant.b2clogin.com/your-b2c-tenant.onmicrosoft.com/{your-sign-in-policy}/oauth2/v2.0/token

5. Verify the group type and user ID format #

• Confirm your group is a security group (Microsoft 365 groups have additional restrictions for membership changes in B2C).
• Ensure your request body uses the correct user ID format—you must reference the user's GUID via the Graph API URL in the @odata.id field:

  {
    "@odata.id": "https://graph.microsoft.com/v1.0/users/{user-guid}"
  }
  

If you've gone through all these steps and still get the error, feel free to share more details like the decoded token's permission fields or a screenshot of your app's API permissions—this can help narrow down the issue further.

内容的提问来源于stack exchange，提问作者Matthias Wirth