title: Azure AD Extension Property + MS Graph API PATCH = Insufficient privileges to complete the operation
body: <p>I've been breaking my head over this problem for the past 2 days.</p>
  
  <p>My goal is to allow a user (any regular non-admin Azure AD user) to update the value of an (Azure AD) extension property for his AD 'profile'/account through the Microsoft Graph API.</p>
  
  <p>Consider the following situation:</p>
  
  <ul>
  <li>I'm in control (Global Admin) of some Azure tenant + Azure AD Directory</li>
  <li>There's a regular Azure AD User "Joe"</li>
  <li>I've created an App registration + Service Principal (either through PS or in the Azure Web UI)</li>
  <li>I've created an Azure AD Extension Property using the following Azure AD PS commands:</li>
  </ul>
  
  <hr>
  
  <pre><code>Connect-AzureAD -TenantId xxx-xxx-xxx
  $app = Get-AzureADApplication -ObjectId yyy-yyy-yyy
  $app | New-AzureADApplicationExtensionProperty -Name "MyProp" -DataType "String" -TargetObjects "User"
  </code></pre>
  
  <p>Response:</p>
  
  <pre><code>Name                                                  TargetObjects
  ----                                                  -------------
  extension_b63fa5d85b9d43b8b60f982e4bf2ad11_MyProp     {User}
  </code></pre>
  
  <hr>
  
  <ul>
  <li>I've Admin consented everything on Graph both on Enterprise Application "Graph Explorer" and on my own App Registration, especially <em>Directory.ReadWriteAll</em> and <em>User.ReadWrite.All</em></li>
  <li>I then use the Graph Explorer (or Postman using my own App Registration) logged on as regular user "Joe"</li>
  <li>Using the following PATCH request fails:</li>
  </ul>
  
  <hr>
  
  <pre><code>PATCH https://graph.microsoft.com/v1.0/me/
  
  with body (type application/JSON):
  
  {
      "extension_b63fa5d85b9d43b8b60f982e4bf2ad11_MyProp": "test"
  }
  </code></pre>
  
  <p>It fails with the following response:</p>
  
  <pre><code>{
      "error": {
          "code": "Authorization_RequestDenied",
          "message": "Insufficient privileges to complete the operation.",
          "innerError": {
              "request-id": "d0ef63c0-f944-44c4-b90d-413b076b2bca",
              "date": "2019-04-11T08:21:48"
          }
      }
  }
  </code></pre>
  
  <p>I seem to be unable to find out why this happens.
  Things to note:</p>
  
  <ul>
  <li>When I log on in Graph Explorer as global admin I am able to update this property successfully</li>
  <li>I am also able to update this property for any user using Azure AD PS, logged in as global admin</li>
  <li>As soon as I give Joe the Global Admin or User Admin role in Azure AD he is able to update the property too</li>
  <li>As "Joe", using the above PATCH request in Graph Explorer (or Postman), I am able to update "mobilephone"</li>
  <li>As "Joe", using the above PATCH request in Graph Explorer (or Postman), I am <strong>unable</strong> to update "city", or "givenname"</li>
  </ul>
  
  <p>What am I doing wrong?</p>