Whenever I try to create a user from Azure AD spoke. I get this error: " Forbidden Request. Please Check Oauth Token and scope permission."

[Roy13]

Hello, 

I followed this (https://youtu.be/JOUBcINNF9g) tutorial to setup my Azure AD spoke. but whenever I try to push a user from ServiceNow to Azure Ad it gives me the following error: "Forbidden Request. Please Check Oauth Token and scope permission."

Everything that I have created is in the Microsoft Azure AD spoke Scope. And my Oauth token is also valid has anyone else encountered this error before? 

[Sravani36]

Hello Richard we are using below graph Api to retrieve the object id from azure by using upn, if we are trying to add multiple users as a input it was able to get only one user response at once for remaining it's showing null or bad request. so here we don't have a chance of using Add multiple users to group.

So we have created multiple user variables in catalog request like user_1,user_2 and below flow will execute for each user but this flow reached the maximum limit and we are able to add only 10 users in single request.

[Richard Hine]

Sravani,

As mentioned previously, I would update the Azure User provisioning to send the azure object id for the user to a hidden field on the sys_user table, then you already have that value in ServiceNow. The Azure object id for a user is immutable so there is no risk to doing this.

Doing it this way also saves you an IntegrationHub activation looking up each user's object id.

Sometimes it is better to take a step back and simplify the problem rather than complicate the solution....

Thanks,

Richard

[Nisha Deol]

Hello Sravani, Roy13

I came across same issues and also found out the solution. May be it will help others who are getting same error.

You need to go to "all the permissions of azure application" There check for Directory.ReadWriteAll because of this 'Directory.ReadWrite.All' permission error error occurred.

Check attached screenshot.

Please click on helpful if you find it. 

Thank You

Nisha

[rachel_bown1]

Hi, Did you get a resolution for this issue please as i am also facing the same error?

Thanks

[Richard Hine]

Rachel,

This issue should only occur if the API permissions in Azure are incorrect.

Best thing to do is open the token retrieved for OAuth using 'Manage tokens' and copy the content into https://jwt.ms and check the permissions granted match those required in the permissions section of this page :-

https://docs.microsoft.com/en-us/graph/api/user-post-users?view=graph-rest-1.0&tabs=http

Hope this helps,

Richard