title: Graph API constantly returns Authorization_RequestDenied although permissions are granted
body: <p>We are trying to use Graph API to set properties of a user account that is managed by Azure AD. The idea is that after the user completes the sign up policy our backend web API is called (by Azure AD) to set some properties that the user can't set by himself (e.g. our internal customer ID for the new user).</p>
  
  <p>Unfortunately, Graph API constantly returns an exception ("Insufficient privileges tom compete this operation") when trying to send the patch request that updates the user.
  I'm trying to grant the permission for all users as an admin because there is no user logged in when the accounts are updated. I basically want my application to be a third party that is able to automatically administrate user profiles.</p>
  
  <p>My code looks like this:</p>
  
  <pre><code>public class GraphAPIClient
  {
      private AuthenticationContext authContext;
      private ClientCredential clientCredential;
      private string adTenant;
  
      public GraphAPIClient(string tenant, string clientID, string clientSecret)
      {
          authContext = new AuthenticationContext("https://login.microsoftonline.com/" + tenant);
          clientCredential = new ClientCredential(clientID, clientSecret);
          adTenant = tenant;
      }
  
      public async Task&lt;string&gt; UpdateUserInfo(string objectID, string jsonUpdate)
      {
          return await SendPatchRequest("/users/" + objectID, jsonUpdate);
      }
  
      private async Task&lt;string&gt; SendPatchRequest(string api, string jsonRequest)
      {
          AuthenticationResult authResult = await authContext.AcquireTokenAsync("https://graph.windows.net/", clientCredential);
          HttpClient httpClient = new HttpClient();
          string url = "https://graph.windows.net/" + adTenant + api + "?" + "api-version=1.6";
  
          HttpRequestMessage request = new HttpRequestMessage(new HttpMethod("PATCH"), url);
          request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", authResult.AccessToken);
          request.Content = new StringContent(jsonRequest, Encoding.UTF8, "application/json");
  
          HttpResponseMessage response = await httpClient.SendAsync(request);
          if(!response.IsSuccessStatusCode)
          {
              string error = await response.Content.ReadAsStringAsync();
              object formattedError = JsonConvert.DeserializeObject(error);
                  throw new Exception("Graph API request failed:\n" + JsonConvert.SerializeObject(formattedError, Formatting.Indented));
          }
  
          return await response.Content.ReadAsStringAsync();
      }
  }
  </code></pre>
  
  <p>I'm using the application ID of the registered application, the tenant of the directory and the key that I have generated in Azure as a client secret. I successfully receive a token.</p>
  
  <p>What I've tried:</p>
  
  <ul>
  <li>I have set (or I think I have) the permissions required to edit users. I've clicked "Grant Permissions" using an admin account and the permissions are displayed when viewing them in the Azure Panel:
  <a href="https://i.stack.imgur.com/T51fy.png" rel="nofollow noreferrer">Image</a></li>
  <li>I've set "Read and write all users' full profiles" and "Read and write directory data". Are those the right permissions for this kind of task?</li>
  <li>I've also tried to use the new Application Registration Console, but with that I get a "The identity of the calling application could not be established" exception when trying to get a token. The applications created in this console aren't visible in the normal Azure AD panel.</li>
  </ul>
  
  <p>Can anyone help me with this? I've searched thoroughly, but most questions regarding this issue are older and recommend to use the old Azure panel. I've tried that and it still doesn't work and I think the new Azure panel only recently received the AD editing functionalities and didn't have them when those questions were asked.</p>
  
  <p>Thank you very much – if you need any more information I'm very happy to provide it.</p>