title: Azure AAD and Graph API: Insufficient privileges to complete the operation
body: <p>Context: I've a console app which wants to use Graph API to talk to AAD to check if a particular userId exists in the tenant or not.</p>
  <p>I've been following the guidelines here: <a href="https://docs.microsoft.com/en-us/graph/auth-v2-service?view=graph-rest-1.0" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/graph/auth-v2-service?view=graph-rest-1.0</a></p>
  <p>I'm able to generate a token using this:</p>
  <pre><code>https://login.microsoftonline.com/common/oauth2/v2.0/token
  client_id=x
  &amp;scope=https%3A%2F%2Fgraph.microsoft.com%2F.default
  &amp;client_secret=x
  &amp;grant_type=client_credentials
  </code></pre>
  <p>But when I call the graph API I get this ERROR:</p>
  <pre><code>https://graph.microsoft.com/v1.0/users/12345678-73a6-4952-a53a-e9916737ff7f
  {
      &quot;error&quot;: {
          &quot;code&quot;: &quot;Authorization_RequestDenied&quot;,
          &quot;message&quot;: &quot;Insufficient privileges to complete the operation.&quot;,
          &quot;innerError&quot;: {
              &quot;request-id&quot;: &quot;x&quot;,
              &quot;date&quot;: &quot;x&quot;
          }
      }
  }
  </code></pre>
  <p>My AAD App has all the permissions from:</p>
  <pre><code>1. Microsoft Graph
  2. Windows Azure Active Directory
  </code></pre>
  <p>I tried changing the scope to</p>
  <pre><code>scope=https%3A%2F%2Fgraph.microsoft.com%2Fuser.read
  </code></pre>
  <p>But this is the error I get while generating token:</p>
  <pre><code>The provided value for the input parameter 'scope' is not valid. The scope https://graph.microsoft.com/user.read is not valid.
  </code></pre>
  <p>I've tried combinations of &quot;User.Read&quot;, &quot;User.Basic.Read&quot;, etc. but nothing works.</p>