title: Insufficient privileges to list group members in Graph API
body: <p>I'm building an API which is called by a SPA (angular). The user is authenticated using Azure AD and the API uses AzureAdBearer for its authentication.</p>
  
  <p>I need the backend to call graph api on behalf of the user to list members of an AD Group.</p>
  
  <p><a href="https://docs.microsoft.com/fr-fr/graph/api/group-list-members?view=graph-rest-1.0&amp;tabs=http" rel="nofollow noreferrer">According to this documentation</a>, I need one of these permissions:</p>
  
  <pre><code>User.ReadBasic.All, User.Read.All, Group.Read.All, Directory.Read.All
  </code></pre>
  
  <p>So I have added User.ReadBasic.All to my api permissions list in the app registration of my backend.
  <a href="https://i.stack.imgur.com/pcx34.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/pcx34.png" alt="backend permissions"></a></p>
  
  <p>I used an <code>IAuthenticationProvider</code> to handle the authentication using this code:</p>
  
  <pre><code>var app = ConfidentialClientApplicationBuilder.Create("{my client id}")
                   .WithAuthority("https://login.microsoftonline.com/{my tenant id}")
                   .WithClientSecret({my backend secret})
                   .WithLogging(Log, Microsoft.Identity.Client.LogLevel.Info, true)
                   .Build();
  
  var token = await _httpContextAccessor.HttpContext.GetTokenAsync("access_token");
  
  var userAssertion = new UserAssertion(token);
  var result = await app.AcquireTokenOnBehalfOf(new[] { "https://graph.microsoft.com/.default" }, userAssertion)
                        .ExecuteAsync();
  
  request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", result.AccessToken);
  
  </code></pre>
  
  <p>The result is successful, when I check my token using jwt.ms everything seems correct, here is an extract of it:</p>
  
  <pre><code>"aud": "https://graph.microsoft.com",
  "iss": "https://sts.windows.net/{my tenant id}/",
  [...]
  "app_displayname": "My app",
  "appid": "{my client id}",
  [...]
  "scp": "User.ReadBasic.All profile openid email",
  [...]
  </code></pre>
  
  <p>However on this call using the GraphApiClient:</p>
  
  <pre><code>var client = new GraphServiceClient(authProvider);
  var users = await client.Groups["group guid"].Members.Request().GetAsync();
  </code></pre>
  
  <p>I get this error:</p>
  
  <pre><code>Code: Authorization_RequestDenied
  Message: Insufficient privileges to complete the operation.
  </code></pre>