title: How to create user (work account) on Azure Active Directory using Graph API
body: <p>I am relatively new to Azure Active Directory and the Graph API. My goal is to be able to write a python program which invokes the Graph APIs to create users in the Azure Active Directory. Let us assume that I have the credentials of the Global Admin for my Azure Active Directory. </p>
  
  <p>I am following the documentation provided at this <a href="https://msdn.microsoft.com/en-us/library/azure/ad/graph/api/users-operations" rel="nofollow noreferrer">link</a>. I am successfully able to create a user by using the Graph Explorer as I am using the Global Admin's credentials to login. However, I am unable to do the same via my python program (or even Postman REST client). I get an error message stating <strong>"Insufficient privileges to complete the operation."</strong> I am using the following python library to obtain an access token using the client credentials: <a href="https://github.com/AzureAD/azure-activedirectory-library-for-python" rel="nofollow noreferrer">ADAL python library</a></p>
  
  <p>It looks like I am not following the correct procedure while obtaining the access token to make my call. I even tried obtaining the access token directly using a REST client. It would be great if someone could review the steps below to highlight any mistakes: </p>
  
  <p>Step 1: Hit the following endpoint </p>
  
  <blockquote>
    <p>[HTTPS]/login.microsoftonline.com/[my-organization]/oauth2/authorize?client_id=[client-id]&amp;response_type=code&amp;response_mode=query&amp;resource=00000002-0000-0000-c000-000000000000</p>
  </blockquote>
  
  <p>Step 2: Note down the 'code' query parameter from the above request. Then make the following request. </p>
  
  <blockquote>
    <p>POST [HTTPS]/login.windows.net/[my-orgranization]/oauth2/token?api-version=1.0</p>
    
    <blockquote>
      <p>HEADERS: </p>
      
      <blockquote>
        <p>Content-type application/x-www-form-urlencoded</p>
      </blockquote>
      
      <p>BODY:</p>
      
      <blockquote>
        <p>code=[code received from Step 1]<br>
        client_id=[client id of my app in Azure]<br>
        client_secret=[client secret of my app in Azure]<br>
        grant_type=authorization_code<br>
        scope=openid<br></p>
      </blockquote>
      
      <p>Please note that the values above were URL encoded appropriately.</p>
    </blockquote>
  </blockquote>
  
  <p>I have even tried sending the global admin's credentials (username/password) in Step 2 as a last ditch effort but to no avail.</p>
  
  <p>Any pointers in this regard would be greatly appreciated.
  Thanks in advance.</p>