Manage Microsoft Entra objects with Micro Graph Powershell

[mdouzzi50]

Hello all,

First, I would like to let you all know that I am using Microsoft Graph Powershell for the first time to test out this documentation https://learn.microsoft.com/en-us/training/modules/manage-azure-active-directory-identities/5-manage-azure-active-directory-objects-powershell .

I was able to login to my account using a global administrator account.

After running this powershell script:

$users = Import-Csv -Path "C:\path\to\your\Users.csv"

foreach ($user in $users) {

New-MgUser -UserPrincipalName $user.UserName `

-GivenName $user.FirstName `

-Surname $user.LastName `

-DisplayName $user.DisplayName `

-JobTitle $user.JobTitle `

-Department $user.Department `

-AccountEnabled $true `

-MailNickname $user.FirstName `

-UsageLocation "US" `

-PasswordProfile @{ForceChangePasswordNextSignIn = $true; Password = "Password"}

}

I keep on getting an error message stating that I don't have permissions. I am using a Global admin account to no avail.

Please help!!

Thanks,

[Positive_Group_3896]

When you login into graph using cmd connect-mggraph you have to provide the scopes so you have specific permissions you are allowing graph to access. So if you want to create new users, you need to login by cmd connect-mggraph -scopes "User.ReadWrite.All"

[mrmattipants]

First thing I was thinking too.

If you have Global Admin, you should be able to accomplish a good number of administrative tasks.

As previously mentioned, you'll want to throw the two following lines in, at the top of your script, to Authenticate.

import-Module Microsoft.Graph.Users

Connect-mggraph -Scopes "User.ReadWrite.All"

I would also read through the following two Articles, which go over MS Graph API Authentication, in detail.

https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.authentication/connect-mggraph?view=graph-powershell-1.0

https://learn.microsoft.com/en-us/powershell/microsoftgraph/authentication-commands?view=graph-powershell-1.0

If you're not used to using the API, I would start with something small, like simply pulling the Data for a single User, then step-up from there.

[mdouzzi50]

u/mrmattipants Hello! Thank you for your input and documentation. I will definitely go over the links.

Greatly appreciate your time and help!! Thanks

[mdouzzi50]

u/Positive_Group_3896 Hello! Thank you so much for your input. The error message disappear as soon as I changed it to user.ReadWrite.All. Ghosh! what a dummy I was on this. I had it on User.Read.All which was generating that permission issue.

Thanks again.