Update users-passwordprofile-permissions.md by tomatsue · Pull Request #9577 · microsoftgraph/microsoft-graph-docs-contrib

tomatsue · 2025-05-26T07:15:55Z

In app-only scenarios, it works without Entra roles such as the User Administrator or the Password Administrator.

Important

Required for API changes:

Add other supporting information, such as a description of the PR changes:

ADD INFORMATION HERE

Important

The following guidance is for Microsoft employees only. Community contributors can ignore this message; our content team will manage the status.

After you've created your PR, expand this section for tips and additional instructions.

do not merge is the default PR status and is automatically added to all open PRs that don't have the ready to merge label.
Add the ready for content review label to start a review. Only PRs that have met the minimum requirements for content review and have this label are reviewed.
If your content reviewer requests changes, review the feedback and address accordingly as soon as possible to keep your pull request moving forward. After you address the feedback, remove the changes requested label, add the review feedback addressed label, and select the Re-request review icon next to the content reviewer's alias. If you can't add labels, add a comment with #feedback-addressed to the pull request.
After the content review is complete, your reviewer will add the content review complete label. When the updates in this PR are ready for external customers to use, replace the do not merge label with ready to merge and the PR will be merged within 24 working hours.
Pull requests that are inactive for more than 6 weeks will be automatically closed. Before that, you receive reminders at 2 weeks, 4 weeks, and 6 weeks. If you still need the PR, you can reopen or recreate the request.

For more information, see the Content review process summary.

tomatsue · 2025-05-26T07:21:59Z

@microsoft-github-policy-service agree company="Microsoft"

learn-build-service-prod · 2025-05-26T07:24:45Z

Learn Build status updates of commit 6548523:

✅ Validation status: passed

File	Status	Preview URL	Details
api-reference/beta/includes/users-passwordprofile-permissions.md	✅Succeeded
api-reference/v1.0/includes/users-passwordprofile-permissions.md	✅Succeeded

For more details, please refer to the build report.

For any questions, please:

Try searching the learn.microsoft.com contributor guides
Post your question in the Learn support channel

FaithOmbongi · 2025-06-04T07:54:50Z

I've pinged @yyuank for SME review and approval.

FaithOmbongi

Hi @tomatsue - Thank you for proposing this correction.

I've checked with the PG and they've confirmed that PasswordProfile.ReadWrite.All app permission is sufficient in app-only scenarios. You don't need UserReadWrite.All. Please confirm you've not seen a different behavior and I can merge this PR with the changes applies.

FaithOmbongi · 2025-06-04T18:03:36Z

  - *Privileged Authentication Administrator* is the least privileged role that's allowed to update this property for *all* administrators in the tenant.
  - In general, the signed-in user must have a higher privileged administrator role as indicated in [Who can reset passwords](/graph/api/resources/users#who-can-reset-passwords).
- In app-only scenarios, the calling app must be assigned a supported permission *and* at least the *User Administrator* [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json).
+- In app-only scenarios, the calling app must be assigned *User-PasswordProfile.ReadWrite.All* and at least *User.ReadWrite.All*.


Suggested change

- In app-only scenarios, the calling app must be assigned *User-PasswordProfile.ReadWrite.All* and at least *User.ReadWrite.All*.

- In app-only scenarios using Microsoft Graph application permissions, *User-PasswordProfile.ReadWrite.All* is the least privileged permission.

FaithOmbongi · 2025-06-04T18:03:59Z

  - *Privileged Authentication Administrator* is the least privileged role that's allowed to update this property for *all* administrators in the tenant.
  - In general, the signed-in user must have a higher privileged administrator role as indicated in [Who can reset passwords](/graph/api/resources/users#who-can-reset-passwords).
- In app-only scenarios, the calling app must be assigned a supported permission *and* at least the *User Administrator* [Microsoft Entra role](/entra/identity/role-based-access-control/permissions-reference?toc=%2Fgraph%2Ftoc.json).
+- In app-only scenarios, the calling app must be assigned *User-PasswordProfile.ReadWrite.All* and at least *User.ReadWrite.All*.


Suggested change

- In app-only scenarios, the calling app must be assigned *User-PasswordProfile.ReadWrite.All* and at least *User.ReadWrite.All*.

- In app-only scenarios using Microsoft Graph application permissions, *User-PasswordProfile.ReadWrite.All* is the least privileged permission.

tomatsue · 2025-06-05T06:23:41Z

Hi @FaithOmbongi, thank you for checking. I've confirmed that an app with User-PasswordProfile.ReadWrite.All permissions can successfully update the passwordProfile via the API. However, for about five minutes after the password reset, the user's sign-in attempts failed with the AADSTS50057 error. In contrast, when the password was reset using both User-PasswordProfile.ReadWrite.All and User.ManageIdentities.All, the user was able to sign in with the new password immediately. Is this an expected result?

tomatsue · 2025-06-05T06:24:16Z

#feedback-addressed

FaithOmbongi · 2025-06-05T07:52:57Z

Hi @tomatsue - AADSTS50057 is definitely not expected. That adding User.ManageIdentities.All worked shows there could have been a different issue for the user account apart from the password.

I recommend the following:

I'll proceed to merge this PR as the eng team has confirmed User-PasswordProfile.ReadWrite.All is all you need.
I recommend you try to repro the same issue with another account and log the request ID. If you encounter the error and have to use User.ManageIdentities.All for the password reset to be complete, please file a bug via the Entra admin center or Q&A and provide the request ID so the issue can be investigated and the root cause identified. If the support team conclude we need to update the documentation, they'll advise us accordingly.

microsoft-github-policy-service · 2025-06-05T07:56:56Z

Thank you for your work in this PR, @@tomatsue.

When the updates in this PR are ready for external customers to use, please replace the do not merge label with ready to merge.

Check the content review workflow here.

learn-build-service-prod · 2025-06-05T08:05:34Z

Learn Build status updates of commit 80925b0:

✅ Validation status: passed

File	Status	Preview URL	Details
api-reference/beta/includes/users-passwordprofile-permissions.md	✅Succeeded
api-reference/v1.0/includes/users-passwordprofile-permissions.md	✅Succeeded

For more details, please refer to the build report.

learn-build-service-prod · 2025-06-05T08:14:18Z

Learn Build status updates of commit dbfa3d9:

✅ Validation status: passed

File	Status	Preview URL	Details
api-reference/beta/includes/users-passwordprofile-permissions.md	✅Succeeded
api-reference/v1.0/includes/users-passwordprofile-permissions.md	✅Succeeded

For more details, please refer to the build report.

tomatsue added 2 commits May 26, 2025 16:01

Update users-passwordprofile-permissions.md

433920d

Update users-passwordprofile-permissions.md

6548523

FaithOmbongi self-assigned this Jun 4, 2025

FaithOmbongi added the content review in progress label Jun 4, 2025

FaithOmbongi requested a review from yyuank June 4, 2025 07:54

FaithOmbongi added area: Entra APIs and issues relating to Microsoft Entra (previously Azure AD) features. area: users labels Jun 4, 2025

microsoft-github-policy-service Bot requested a review from FaithOmbongi June 4, 2025 07:54

FaithOmbongi added the awaiting internal response label Jun 4, 2025

FaithOmbongi requested changes Jun 4, 2025

View reviewed changes

FaithOmbongi added changes requested needs author feedback Waiting for author (creator) of issue to provide more info and removed awaiting internal response labels Jun 4, 2025

FaithOmbongi self-requested a review June 4, 2025 18:06

microsoft-github-policy-service Bot assigned tomatsue Jun 4, 2025

microsoft-github-policy-service Bot added the review feedback addressed label Jun 5, 2025

FaithOmbongi reviewed Jun 5, 2025

View reviewed changes

Comment thread api-reference/beta/includes/users-passwordprofile-permissions.md Outdated

FaithOmbongi added 2 commits June 5, 2025 10:54

Update users-passwordprofile-permissions.md

80925b0

Update users-passwordprofile-permissions.md

dbfa3d9

FaithOmbongi approved these changes Jun 5, 2025

View reviewed changes

FaithOmbongi added content review complete Apply when the content review is complete on a PR. and removed changes requested content review in progress needs author feedback Waiting for author (creator) of issue to provide more info labels Jun 5, 2025

microsoft-github-policy-service Bot removed the review feedback addressed label Jun 5, 2025

FaithOmbongi merged commit 04cf937 into microsoftgraph:main Jun 5, 2025
7 checks passed

	- In app-only scenarios, the calling app must be assigned User-PasswordProfile.ReadWrite.All and at least User.ReadWrite.All.
	- In app-only scenarios using Microsoft Graph application permissions, User-PasswordProfile.ReadWrite.All is the least privileged permission.

Conversation

tomatsue commented May 26, 2025

Uh oh!

tomatsue commented May 26, 2025

Uh oh!

learn-build-service-prod Bot commented May 26, 2025

✅ Validation status: passed

Uh oh!

FaithOmbongi commented Jun 4, 2025

Uh oh!

FaithOmbongi left a comment

Choose a reason for hiding this comment

Uh oh!

FaithOmbongi Jun 4, 2025

Choose a reason for hiding this comment

Uh oh!

FaithOmbongi Jun 4, 2025

Choose a reason for hiding this comment

Uh oh!

tomatsue commented Jun 5, 2025

Uh oh!

tomatsue commented Jun 5, 2025

Uh oh!

FaithOmbongi commented Jun 5, 2025

Uh oh!

Uh oh!

microsoft-github-policy-service Bot commented Jun 5, 2025

Uh oh!

learn-build-service-prod Bot commented Jun 5, 2025

✅ Validation status: passed

Uh oh!

learn-build-service-prod Bot commented Jun 5, 2025

✅ Validation status: passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants