Authentication error when running 'Add user to Group' and 'Remove member from Group'

[HayleyECC]

I have built a flow which extracts 'Action', 'User' and 'Group' variables from an incoming email to inform the 'Add user to Group' or 'Remove member from Group' step (depending on the 'Action' variable).  However, when I run the flow, it fails at the AAD step with the following error:

{

"error": {

    "code": "Authorization_RequestDenied",

    "message": "Insufficient privileges to complete the operation.",

    "innerError": {

      "request-id": "9a3f88eb-c7a8-47ee-82b2-216502273f58",

      "date": "2019-11-07T13:59:47"

    }

  }

}

If we give the service account admin rights it will be subject to MFA, is there any way around that?

Thanks.

[Pstork1]

Since Admin rights are required to perform those actions there is no way to get around having admin rights for that connection.  However the MFA should only hit when you first run the Flow.  Once the connection is established I don't think you will get re-prompted for MFA.

[HayleyECC]

Thank you - will give it a try! 🙂

[HayleyECC]

 The service account now has the 'User Management Administrator' role and is registered for MFA, but I'm getting the same error in the 'Add user to group' step.... any suggestions/ideas appreciated.  Thanks.

[Jcook · Accepted solution]

Hello @HayleyECC 

Is the Connection you are using for that action "Add user to AAD group" a owner for that group?

The connection you are using for that action must be a owner in that AD group.

Thanks, hope this helps!

-Josh

[HayleyECC]

That's sorted it - thank you!