Authorization_RequestDenied: the admin centre refuses your change

Fix it now

Authorization_RequestDenied is “Insufficient privileges to complete the operation”. Entra ID accepted who you are and refused what you asked to do: the signed-in account lacks the directory role, or the app registration lacks the Microsoft Graph permission, that the operation requires.

Get-MgContext
Connect-MgGraph -Scopes "User.ReadWrite.All"
Get-MgContext | Select -ExpandProperty Scopes

1. Read the Scopes line from Get-MgContext. It shows the permissions the session actually holds, not the ones you asked for.
2. In the Entra admin centre open Roles and administrators, find the role you believe you have, open Assignments and confirm your account is genuinely listed.
3. If you use Privileged Identity Management, activate the role. An eligible assignment grants nothing until it is activated.
4. For an app-only script, check App registrations, API permissions: the matching application permission must be there and must have admin consent granted.
5. Sign out and back in after any role change so a fresh token carries the new claims.

Being a Global Administrator in one portal does not carry into every Graph operation. The token has to carry the scope.

If the operation now succeeds you can stop here. If not, the next section covers the three other codes that arrive at the same screen from somewhere else.

Why it happens

Two separate things have to line up before Graph will do what you asked, and this error means one of them did not. The first is the directory role held by the principal making the call – a person, or the service principal behind an app registration. The second is the permission on the token itself: a delegated scope for a signed-in user, or an application permission with admin consent for app-only calls. A correct role with the wrong scope fails, and so does the reverse.

Microsoft’s troubleshooting for this code works through exactly those two: assign an appropriate Microsoft Entra RBAC role to the app registration – it uses User Administrator as the example for managing users – and add the required API permissions, then grant admin consent. It also names the least-privileged pairing for a specific job, which is a good model for the rest: to change the accountEnabled property on administrator accounts you need Privileged Authentication Administrator, and the permissions User.EnableDisableAccount.All together with User.Read.All.

The other three codes in this article are not permission failures at all, and it is worth being honest about how thinly they are documented. Request_BadRequest appears in Microsoft’s guidance on group sensitivity labels, where it is returned because the directory settings already exist and creating a new property:value pair therefore fails – the remedy is to update the existing settings object rather than create another. Request_ResourceNotFound appears as the expected 404 when an application is not present in the tenant. Neither has a published general definition, so treat any confident universal meaning for them with caution.

Directory_QuotaExceeded is the one with a real number behind it. A non-administrator may create no more than 250 Microsoft Entra resources – applications and service principals – and both active resources and soft-deleted ones that are still available to restore count towards that limit. Deleting an application does not free the quota; permanently deleting it from the deleted items container does. Soft-deleted objects remain restorable for up to 30 days.

Full reference

Role, permission, or neither

A worked least-privilege example

Microsoft’s own example on this error is useful because it shows both halves at once. To enable or disable a user account through Graph you need the permission User.EnableDisableAccount.All in combination with User.Read.All. To do the same thing to an administrator’s account you additionally need the Privileged Authentication Administrator role, because changing an administrator’s sign-in state is a privileged operation regardless of which permission the token carries.

Reading a Graph error properly

• The code field is the machine-readable name – Authorization_RequestDenied – and the message field is the human sentence. Quote the code, not the sentence, when searching.
• The innererror object often carries a request-id and a date. Keep both: they are what support asks for.
• An HTTP 403 with this code is a privileges problem. An HTTP 403 with a different code may not be.
• A 404 is not always absence. Graph returns Request_ResourceNotFound when an object exists but the caller cannot see it, which looks identical from the client.

Object quotas worth knowing

The soft-delete detail is the part that surprises people. A developer who has tidied up conscientiously by deleting their old app registrations is still at the quota, because deleted-but-restorable objects continue to count. Permanent deletion from the deleted items container is what actually frees the allowance.

When the role and the scope both look right

• Confirm you are operating against the tenant you think you are. A token for the wrong tenant produces confident-looking failures.
• Check whether the target object is itself protected. Operations against administrators, and against role-assignable groups, need higher privilege than the same operation against ordinary objects.
• Look for Conditional Access on the sign-in that issued the token; a policy can restrict what the session is allowed to do.
• Re-authenticate. A token issued before a role change does not gain the role, and sessions can be long-lived.
• For app-only calls, confirm admin consent was granted for the tenant rather than merely requested.

Every code this article covers

Confirm the fix worked

1. Get-MgContext shows the scope the operation needs in its Scopes list.
2. Roles and administrators shows your account under Assignments for the role you expect, as an active rather than eligible assignment.
3. For an app-only call, API permissions shows the application permission with admin consent granted.
4. The operation completes and returns the object rather than a 403.
5. The role you used is the least-privileged one that works, not Global Administrator by default.

Questions people ask about this