title: Microsoft Graph API - Update password - Insufficient privileges to complete the operation
body: <p>I am trying to update a user via Microsoft Graph API, I am able to update the <code>DisplayName</code> but the <code>PasswordProfile</code> I get an error:</p>
  
  <pre><code>Insufficient privileges to complete the operation.
  </code></pre>
  
  <p>Here are the roles associated to the token when I decoded the JWT token at <a href="http://jwt.io" rel="noreferrer">http://jwt.io</a> :</p>
  
  <pre class="lang-js prettyprint-override"><code>"roles": [
      "User.ReadWrite.All",
      "Directory.ReadWrite.All",
      "Group.ReadWrite.All"
  ],
  </code></pre>
  
  <p>Based on <a href="https://developer.microsoft.com/en-us/graph/docs/concepts/permissions_reference" rel="noreferrer">the documentation</a> it seems these permissions should suffice. </p>
  
  <p>Here is my code (taken from a console app), I was able to figure out the call is failing via Fiddler, the <code>UpdateAsync</code> does not throw an exception. </p>
  
  <pre class="lang-cs prettyprint-override"><code>try
  {
      var userId = "9a5413cd-85ff-4ad1-ab2f-b443941abd8e";
      var token = GetToken().Result;
      System.Console.Write($"Token: {token}");
  
      var newPassword = "TwDx5zgHxe51DZZ";
      GraphServiceClient graphClient = GetAuthenticatedClient(token);
  
      // This works -- Updating Display name
      graphClient.Users[userId].Request().UpdateAsync(new User
      {
          DisplayName = "NewDisplayName"
      });
  
      // This does not work - Updating password
      graphClient.Users[userId].Request().UpdateAsync(new User
      {
          PasswordProfile = new PasswordProfile
          {
              Password = newPassword,
                  ForceChangePasswordNextSignIn = true
          }
      });
      System.Console.WriteLine("---Update Complete---");
  }
  catch (Exception e)
  {
      System.Console.WriteLine(e);
  }
  </code></pre>
  
  <p>Method for getting token:</p>
  
  <pre class="lang-cs prettyprint-override"><code>public async Task&lt;string&gt; GetToken()
  {
      //  Constants
      var tenant = "dev-mytenantmydomaincom";
      var resource = "https://graph.microsoft.com/";
      var clientID = "XXXXXXXX-87ef-494d-b921-cf8956006b0e";
      var secret = "zgkzas2THJLiD5XXXXXX";
  
      //  Ceremony
      var authority = $"https://login.microsoftonline.com/{tenant}";
      var authContext = new AuthenticationContext(authority);
      var credentials = new ClientCredential(clientID, secret);
      var authResult = await authContext.AcquireTokenAsync(resource, credentials);
      return authResult.AccessToken;
  }
  </code></pre>
  
  <p>Here is the full response via Fiddler:</p>
  
  <pre class="lang-js prettyprint-override"><code>HTTP/1.1 403 Forbidden
  Cache-Control: private
  Transfer-Encoding: chunked
  Content-Type: application/json
  request-id: 6edcf194-7705-4cd7-8144-767925cc9ee4
  client-request-id: 6edcf194-7705-4cd7-8144-767925cc9ee4
  x-ms-ags-diagnostic: {"ServerInfo":{"DataCenter":"East US","Slice":"SliceB","ScaleUnit":"001","Host":"AGSFE_IN_27","ADSiteName":"EST"}}
  Duration: 69.2849
  Date: Thu, 31 Aug 2017 13:15:34 GMT
  
  {
      "error": {
          "code": "Authorization_RequestDenied",
              "message": "Insufficient privileges to complete the operation.",
                  "innerError": {
              "request-id": "6edcf194-7705-4cd7-8144-767925cc9ee4",
                  "date": "2017-08-31T13:15:34"
          }
      }
  }    
  </code></pre>