title: Access denied for setting up Azure B2B allow list domain using Graph API
body: <p>I've created an registered app in Azure and I'be given the following API permissions for Graph API as follows: </p>
  
  <pre><code>**
  Directory.ReadWrite.All
  Policy.Read.All 
  Policy.ReadWrite.TrustFramework
  User.Invite.All
  User.Read
  **
  </code></pre>
  
  <p>My plan is to add an allow list to the Azure B2B directory and then invite the guest user to my directory using the service principle i created above.</p>
  
  <p>With the above permissions , I can read the current policy and send the invite to the guest user. But, I cannot append the exiting allowed domain list in my B2B directory. </p>
  
  <p>Each time i try to update the existing policy I'm getting access denied as shown below:</p>
  
  <pre><code>**
  Set-AzureADPolicy -Definition $policyValue -Id $currentpolicy.Id | Out-Null**
  
  Error
  
  Set-AzureADPolicy : Error occurred while executing SetPolicy 
  Code: Authorization_RequestDenied
  Message: Insufficient privileges to complete the operation.
  InnerError:
    RequestId: 4f161b70-f71c-4507-8b91-788457429fcc
    DateTimeStamp: Wed, 08 Apr 2020 16:57:39 GMT
  HttpStatusCode: Forbidden
  HttpStatusDescription: Forbidden
  HttpResponseStatus: Completed
  At line:1 char:1
  + Set-AzureADPolicy -Definition $policyValue -Id $currentpolicy.Id | Ou ...
  + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      + CategoryInfo          : NotSpecified: (:) [Set-AzureADPolicy], ApiException
      + FullyQualifiedErrorId : Microsoft.Open.MSGraphBeta.Client.ApiException,Microsoft.Open.MSGraphBeta.PowerShell.SetPolicy
  </code></pre>
  
  <p>Does anyone had any ideas what is missing here? </p>
  
  <p>Also can i confirm this operation is supported with Graph API at the moment? </p>
  
  <p>Thanks
  Balaip</p>