Azure device role sync fails with “Insufficient privileges”

symptoms when synchronizing an activate system role whose members parameter selects devices from an azure active directory organizational unit activate identifies the expected devices during synchronisation the devices may appear in the active directory cache the synchronisation finishes without adding the devices to the system role the same configuration may work in another environment, even when both environments use the same azure app registration increasing the azure connector trace level may not initially reveal the problem a full synchronisation may show the following error did not find a previous role sync token to use full sync is enabled error updating cache for azure devices microsoft graph models odataerrors odataerror insufficient privileges to complete the operation at innovation activate connectors virtualldapbase execsync\[t]\( ) at innovation activate connectors azuread azuredirectoryprovider syncgroups( ) at innovation activate connectors azuread azuredirectoryprovider syncusers( ) at innovation activate role internalsyncadmembers( ) cause the microsoft entra id application registration used by the activate azure ad connector does not have sufficient microsoft graph permissions to read all directory information required during the role synchronisation the devices can still appear in parts of the synchronisation or cache because some directory queries succeed a later microsoft graph request fails when activate attempts to resolve the complete membership information resolution grant the application registration the following microsoft graph application permission directory read all an entra id administrator must then grant tenant wide admin consent for the permission to configure the permission open the microsoft entra admin center go to app registrations select the application registration used by the activate azure ad connector open api permissions select add a permission select microsoft graph select application permissions add directory read all select grant admin consent for the tenant confirm that the permission status shows that consent has been granted run the activate role membership synchronisation again after the permission and admin consent are granted, the azure devices should be added to the system role successfully additional checks if the problem continues confirm that activate is using the expected tenant and application registration verify that directory read all was added as an application permission, not only as a delegated permission confirm that admin consent was granted in the tenant used by the affected environment check whether the production and uat environments use different credentials, service principals, tenants, or connector settings despite referencing the same application registration note about device read all device read all provides access to device information, but this issue was resolved by granting directory read all because the role synchronisation also required broader directory data only grant permissions that have been reviewed and approved according to your organization’s security policies