Azure / Azure/azure-powershell

New-AzADApplication returns Az.MSGraph.internal\New-AzADApplication : Insufficient privileges to complete the operation

Open
#17,010 13 comments 0 reactions 1 assignee Claimed by @VeryEarly View on GitHub
AAD act-identity-squad bug customer-reported feature-request
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
2d 17h
Merged PRs (30d)
51

Description

### Description

Hello.
I want to create a SAML app using application template ID for custom apps - 8adf8e6e-67b2-4cf2-a259-e3dc5476c621, I use
`New-AzADApplication -DisplayName test-ag-asdsa2 -ApplicationTemplateId 8adf8e6e-67b2-4cf2-a259-e3dc5476c621` but receive this error:
```
Az.MSGraph.internal\New-AzADApplication : Insufficient privileges to complete the operation.
At C:\Program Files\WindowsPowerShell\Modules\Az.Resources\5.2.0\MSGraph.Autorest\custom\New-AzADApplication.ps1:702 char:5
+ $app = Az.MSGraph.internal\New-AzADApplication @PSBoundParameters
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: ({ body = {
"...reADMyOrg"
} }:<>f__AnonymousType6`1) [New-AzADApplication_CreateExpanded], Exception
+ FullyQualifiedErrorId : Authorization_RequestDenied,Microsoft.Azure.PowerShell.Cmdlets.Resources.MSGraph.Cmdlets.NewAzADApplication_CreateExpanded
```

New-AzADApplication work well if I don't use -ApplicationTemplateId parameter. So I'm not sure what privileges are required and where should I specify them, because I logged in using my uesr account, not SP.

### Issue script & Debug output

```PowerShell
New-AzADApplication -DisplayName test-ag-asdsa2 -ApplicationTemplateId 8adf8e6e-67b2-4cf2-a259-e3dc5476c621 -Debug
DEBUG: [CmdletBeginProcessing]: Starting command

Confirm
Continue with this operation?
[Y] Yes [A] Yes to All [H] Halt Command [S] Suspend [?] Help (default is "Y"): A
DEBUG: CmdletBeginProcessing:
DEBUG: CmdletProcessRecordStart:

Confirm
Are you sure you want to perform this action?
Performing the operation "New-AzADApplication_CreateExpanded" on target "Call remote 'ApplicationsApplicationCreateApplication' operation".
[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "Y"): A
DEBUG: [CmdletProcessRecordAsyncStart]: Created new QosEvent for command 'New-AzADApplication_CreateExpanded'
DEBUG: CmdletProcessRecordAsyncStart:
DEBUG: CmdletGetPipeline:
DEBUG: CmdletBeforeAPICall:
DEBUG: URLCreated: /applications
DEBUG: RequestCreated: /v1.0/applications
DEBUG: HeaderParametersAdded:
DEBUG: BodyContentSet:
DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
POST

Absolute Uri:
https://graph.microsoft.com/v1.0/applications

Headers:
x-ms-unique-id : 86
x-ms-client-request-id : 1c301888-b279-4349-9028-f43fdbb36186
CommandName : Az.MSGraph.internal\New-AzADApplication
FullCommandName : New-AzADApplication_CreateExpanded
ParameterSetName : __AllParameterSets
User-Agent : AzurePowershell/v0.0.0,PSVersion/v5.1.19041.1320,Az.MSGraph/5.2.0

Body:
{
"displayName": "test-ag-asdsa2",
"applicationTemplateId": "8adf8e6e-67b2-4cf2-a259-e3dc5476c621",
"signInAudience": "AzureADMyOrg"
}

DEBUG: BeforeCall:
DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
Forbidden

Headers:
Transfer-Encoding : chunked
Strict-Transport-Security : max-age=31536000
request-id : 6e136ea7-8d00-464d-9c29-45bf6998f1c8
client-request-id : 6e136ea7-8d00-464d-9c29-45bf6998f1c8
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"West Europe","Slice":"E","Ring":"5","ScaleUnit":"004","RoleInstance":"AM2PEPF00005517"}}
x-ms-resource-unit : 1
Cache-Control : no-cache
Date : Fri, 04 Feb 2022 13:06:13 GMT

Body:
{
"error": {
"code": "Authorization_RequestDenied",
"message": "Insufficient privileges to complete the operation.",
"innerError": {
"date": "2022-02-04T13:06:13",
"request-id": "6e136ea7-8d00-464d-9c29-45bf6998f1c8",
"client-request-id": "6e136ea7-8d00-464d-9c29-45bf6998f1c8"
}
}
}

DEBUG: ResponseCreated:
DEBUG: BeforeResponseDispatch:

Confirm
Insufficient privileges to complete the operation.
[Y] Yes [A] Yes to All [H] Halt Command [S] Suspend [?] Help (default is "Y"): A
Az.MSGraph.internal\New-AzADApplication : Insufficient privileges to complete the operation.
At C:\Program Files\WindowsPowerShell\Modules\Az.Resources\5.2.0\MSGraph.Autorest\custom\New-AzADApplication.ps1:702 char:5
+ $app = Az.MSGraph.internal\New-AzADApplication @PSBoundParameters
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: ({ body = {
"...reADMyOrg"
} }:<>f__AnonymousType6`1) [New-AzADApplication_CreateExpanded], Exception
+ FullyQualifiedErrorId : Authorization_RequestDenied,Microsoft.Azure.PowerShell.Cmdlets.Resources.MSGraph.Cmdlets.NewAzADApplication_CreateExpanded
DEBUG: [Finally]: Getting exception 'Microsoft.Azure.Commands.Common.Exceptions.AzPSCloudException: InternalException' from response
DEBUG: Finally:
DEBUG: CmdletAfterAPICall:
DEBUG: [CmdletProcessRecordAsyncEnd]: Finish HTTP process
DEBUG: CmdletProcessRecordAsyncEnd:
DEBUG: CmdletProcessRecordEnd:
DEBUG: AzureQoSEvent: Module: Az.MSGraph:5.2.0; CommandName: New-AzADApplication_CreateExpanded; PSVersion: 5.1.19041.1320; IsSuccess: False; Duration: 00:00:00;
Exception: InternalException;
DEBUG: Finish sending metric.
DEBUG: CmdletEndProcessing:
```

### Environment data

```PowerShell
Name Value
---- -----
PSVersion 5.1.19041.1320
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.19041.1320
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
```

### Module versions

```PowerShell
ModuleType Version Name
---------- ------- ----
Script 2.7.1 Az.Accounts
Script 1.7.3 Az.Automation
Script 5.2.0 Az.Resources
Binary 2.0.2.138 AzureADPreview
```

### Error output

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.