[SOLVED] minimum permissions that are required for serviceprincipal account to enumerate user profile info

minimum permissions that are required for serviceprincipal account to enumerate user profile info

what permissions does the service principal need to enumerate user profile info i.e. department, email, etc..

I have the following assigned but get a permission error. if I assign user admin role to the app then it works. but I am uncomfortable adding that role to the app.

Solution

Note that: Connecting to Azure AD PowerShell module requires assigning of Directory Readers role (in your scenario) to the app registration along with API permissions too. Refer this blog by NoVestigeOfBeginning.

Without assigning roles I got error "Insufficient privileges to complete the operation":

To get the user profile information grant User.Read.All application API permission:

enter image description here

And add active assignment of Directory readers role to the application:

enter image description here

I am able to fetch user's profile based on your requirement successfully:

# Define your tenant ID, application ID, and certificate thumbprint
$tenantId = "TenantID"
$applicationId = "APPID"
$certThumbprint = "CertTumbPrint"

# Connect to Azure AD using the certificate
Connect-AzureAD -CertificateThumbprint $certThumbprint -ApplicationId $applicationId -TenantId $tenantId

# Define the company name to filter by
$companyName = "ruk"

$users = Get-AzureADUser -All $true | Where-Object {
    $_.CompanyName -eq $companyName -and $_.JobTitle -ne $null
    } | Select-Object DisplayName, JobTitle, Mail, Department

# Export the filtered users to a CSV file
$users

enter image description here

Otherwise, make use of Microsoft Graph PowerShell module as Azure AD PowerShell module will be deprecated:

The below requires User.Read.All application type API permissions granted to the application.
There is no need add any other Microsoft Entra ID roles to make it work.

# Define your tenant ID, client ID, and certificate thumbprint
$tenantId     = "TenantID"
$clientId     = "ClientID"
$certThumbprint = "CertThumbprint"
$companyName  = "ruk"

# Connect to Microsoft Graph using client credentials and certificate
Connect-MgGraph -ClientId $clientId -TenantId $tenantId -CertificateThumbprint $certThumbprint

# Retrieve users with filtering and selecting specific properties
$filteredUsers = Get-MgUser -Filter "companyName eq '$companyName' and jobTitle ne null" `
                            -Select "displayName,jobTitle,mail,department" `
                            -CountVariable CountVar `
                            -ConsistencyLevel Eventual

# Output the filtered users
$filteredUsers | Format-Table -Property displayName, jobTitle, mail, department -AutoSize

enter image description here

You can also make use of invoke rest method as suggested by @wenbo.

Reference:

Use Microsoft Graph PowerShell authentication commands | Microsoft

UPDATE:

To get the results use Top operator:

# Define your tenant ID, client ID, and certificate thumbprint
$tenantId        = "TenantID"
$clientId        = "ClientID"
$certThumbprint  = "CertThumbprint"
$companyName     = "ruk"
$topResults      = 500

# Connect to Microsoft Graph using client credentials and certificate
Connect-MgGraph -ClientId $clientId -TenantId $tenantId -CertificateThumbprint $certThumbprint

# Retrieve users with filtering, selecting specific properties, and limiting the number of results
$filteredUsers = Get-MgUser -Filter "companyName eq '$companyName' and jobTitle ne null" `
                            -Select "displayName,jobTitle,mail,department" `
                            -Top $topResults `
                            -CountVariable CountVar `
                            -ConsistencyLevel Eventual

# Output the filtered users
$filteredUsers | Format-Table -Property displayName, jobTitle, mail, department -AutoSize