Graph API permissions required to use onPremisesPublishing?

Question

Hi ,

I am following documentation to create App Proxy applications via the Graph API.
https://learn.microsoft.com/en-us/graph/application-proxy-configure-api?tabs=http#step-2-configure-application-proxy-properties

I am receiving 403 unauthorized when performing PATCH against onPremisesPublishing object.

{
"error": {
"code": "NotAdminRoleNoEnoughCustomPermission_UnauthorizedAccess",
"message": "Unauthorized Access.",
"innerError": {
"date": "2021-03-03T12:13:42",
"request-id": "",
"client-request-id": ""
}
}
}

I have delegated permissions set for:
Directory.ReadWrite.All
Applications.ReadWrite.All
OnPremisesPublishingProfiles.ReadWrite.All

Which other permissions would this API require?
Thanks!

Answer 1

@NDNMD I suspect that the signed-in user needs to be in either Cloud Application Administrator or the Application Administrator role. With delegated permissions the service looks at both the permissions granted to the app AND the permissions that the signed-in user has. and decides whether the combo means that the user+app have access to the API operation.
See https://learn.microsoft.com/en-us/graph/auth/auth-concepts#delegated-and-application-permissions for more info on delegated permissions.

Hope this helps
Dan