Disable privileged account does not work, anymore

[anthonyvandenbossche]

I have a function app that creates user accounts in an Azure AD tenant using an app registration and application permissions. Since it is a PIM solution, it also adds newly created users to Role-Assigned groups (for example a group that is assigned to the Global Admins role). After an allotted amount of time, the tool will remove the user from the group (therefor removing the privilege), and then disable the account. This disable action fails since the beginning of this week with "Request_BadRequest Message: Property 'isSipEnabled' is read-only and cannot be set.". When an enable of that same user account is tried, the same error pops up. Deleting a privileged user is not a problem, strangely.

The app has a number of application api perms (user.readwrite.all, group.readwrite.all and RoleManagement.ReadWrite.Directory). To facilitate enabling/disabling of the account, an Azure AD role was granted to the app registration: Privileged Authentication Administrator.

Extra info: the app is using:

• .NET 6
• Microsoft.Graph 4.24.0

[andrueastman]

Thanks for raising this @anthonyvandenbossche

Is the user object being sent for the UpdateAsync the same object from a previous API request? Any chance you can confirm there is a isSipEnabled property present in the object or in the AdditionalData?

[anthonyvandenbossche]

Hi @andrueastman, I was indeed referencing an object from a previous request. This is not a good idea so it seems. Code was adapted to:

This seems to work! Thanks for your feedback!!