title: Azure AD app with Application.ReadWrite.OwnedBy cannot add more owners to apps it created
body: <p>I have an AAD app that creates other AAD apps. The first app (creator) has right <code>Application.ReadWrite.OwnedBy</code> and is able to update display names of the apps it created but it is not able to add more owners on those apps. Does it need more privileges to do that?</p>
  
  <p>HTTP request updating the created-app display name (succeeds):</p>
  
  <pre><code>PATCH https://graph.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/applications/a1236923-6de6-4e78-87dd-494d621fc20c?api-version=1.6 HTTP/1.1
  Authorization: Bearer eyJ0eXAi...
  Content-Type: application/json; charset=utf-8
  Host: graph.windows.net
  Content-Length: 45
  Expect: 100-continue
  
  {
    "displayName": "test"
  }
  </code></pre>
  
  <p>HTTP request adding an owner to the created-app (fails):</p>
  
  <pre><code>POST https://graph.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/applications/a1236923-6de6-4e78-87dd-494d621fc20c/$links/owners?api-version=1.6 HTTP/1.1
  Authorization: Bearer eyJ0eXAi...
  Content-Type: application/json; charset=utf-8
  Host: graph.windows.net
  Content-Length: 122
  Expect: 100-continue
  
  {
    "url": "https://graph.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/users/ac990eb3-b25a-4e06-ade5-41c7613693ff"
  }
  
  
  HTTP/1.1 403 Forbidden
  request-id: 9be47e62-abcd-4768-926f-ffd62544e696
  client-request-id: 149115f6-c9b7-4dd4-a267-711a40c51f23
  ...
  
  {"odata.error":{"code":"Authorization_RequestDenied","message":{"lang":"en","value":"Insufficient privileges to complete the operation."}}}
  </code></pre>
  
  <p>I verified that the creator app does indeed have <code>Application.ReadWrite.OwnedBy</code> in the roles array of the JWT Bearer token.</p>
  
  <p>I also verified that the creator app is present in the owner list of the created app by calling <code>GET https://graph.windows.net/72f988bf-86f1-41af-91ab-2d7cd011db47/applications/a1236923-6de6-4e78-87dd-494d621fc20c/owners/64898a3a-2fb1-45f0-a514-e83fabbc01f2</code>.</p>