add user to group spoke error in integration with azure

[AlekhyaD2093158]

Hi,

Am receiving this error when trying to add user to azure group 
{"Action Status": {
"code": 1,
"message": "Error: Forbidden Request. Please Check Oauth Token and scope permission. (Process Automation.b88d792d1bb1b510fb427c95464bcb7c; line 6)"
}}

Below are the permissions added. Can someone please let me know what else permissions are missing ?

[AlekhyaD2093158]

Added the below scopes in both registry and profile

[Muhammad Salar]

Are you using client credentials flow?

Try with this script and modify client id/secret, user/group id

var clientId = '';
var clientSecret = '';
var tenantId = '';

var tokenUrl = 'https://login.microsoftonline.com/' + tenantId + '/oauth2/v2.0/token';

var rm = new sn_ws.RESTMessageV2();
rm.setHttpMethod('POST');
rm.setEndpoint(tokenUrl);

var requestBody = 'grant_type=client_credentials' +
    '&client_id=' + clientId +
    '&client_secret=' + clientSecret +
    '&scope=https://graph.microsoft.com/.default';

rm.setRequestBody(requestBody);
rm.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');

var response = rm.execute();
var responseBody = response.getBody();
var statusCode = response.getStatusCode();

if (statusCode == 200) {
    var responseObj = JSON.parse(responseBody);
    var accessToken = responseObj.access_token;

    // Step 1: Get the user's object ID from UPN
    var userUPN = 'your_user_id';
    var userLookup = new sn_ws.RESTMessageV2();
    userLookup.setHttpMethod('GET');
    userLookup.setEndpoint('https://graph.microsoft.com/v1.0/users/' + encodeURIComponent(userUPN));
    userLookup.setRequestHeader('Authorization', 'Bearer ' + accessToken);
    userLookup.setRequestHeader('Content-Type', 'application/json');

    var userResponse = userLookup.execute();
    var userStatus = userResponse.getStatusCode();

    if (userStatus == 200) {
        var userObj = JSON.parse(userResponse.getBody());
        var userId = userObj.id;
		gs.info('userId '+userId);

        // Step 2: Add user to the group
        var groupId = 'group_id';
        var addUser = new sn_ws.RESTMessageV2();
        addUser.setHttpMethod('POST');
        addUser.setEndpoint('https://graph.microsoft.com/v1.0/groups/' + groupId + '/members/$ref');
        addUser.setRequestHeader('Authorization', 'Bearer ' + accessToken);
        addUser.setRequestHeader('Content-Type', 'application/json');

        var payload = JSON.stringify({
            "@odata.id": "https://graph.microsoft.com/v1.0/directoryObjects/" + userId
        });

        addUser.setRequestBody(payload);
        var addResponse = addUser.execute();
        var addStatus = addResponse.getStatusCode();

        if (addStatus == 204) {
            gs.info('User successfully added to group.');
        } else {
            gs.error('Failed to add user. Status: ' + addStatus + ', Response: ' + addResponse.getBody());
        }

    } else {
        gs.error('Failed to retrieve user. Status: ' + userStatus + ', Response: ' + userResponse.getBody());
    }

} else {
    gs.error('Failed to obtain access token. Status: ' + statusCode + ', Response: ' + responseBody);
}

[Luiz Lucena]

I'm seeing the same issue with the out of the box action. However, when running in our DEV instance (which uses its own App Registration in Azure) it works fine. 
Also, running that action in PRD with the "Test" button, works fine as well.
Just when running from the Flow it fails however is something else failing, not the action itself. I can see the user was actually added to the Entra group and can confirm by looking at the logs:

So, permissions seems to be correct because we were able to add user to group when running the action aside of a Flow. 
But it doesn't make any sense failing within the Flow with this message: 
"code":"Authorization_RequestDenied","message":"Insufficient privileges to complete the operation."