Set the Azure Active Directory for role enumeration

The Microsoft Graph API should be used to enumerate the groups in the Azure Active Directory tenant. It may also be used to get directory information. However, this requires an access token with correct permissions.

To request API permissions:

1. From the API permissions page, select Add a permission.

   

2. Select APIs my organization uses.

   

3. Select Microsoft Graph. You can search for “Microsoft Graph” if the option is not shown in the list. The Microsoft Graph page appears.

   

4. Select Application permissions. This enables the application to run as a background service or daemon without a signed-in user.

   

5. Under Select permissions, enter “Group” in the search box.

6. Click to select the required group or groups and select Add permissions.

   • GroupMember.Read.All access to Microsoft.Graph, and admin consent must be granted for this permission, and it can then require a client API token using client_credentials,

   • Organization.Read.All access to Microsoft.Graph

   • User.Read.All access to Microsoft Graph

     Note: The groups must be the Application type, not the Delegated type.

7. Grant admin consent.