Unable to add users to role-assignable groups

issue activate fails to add a user as a member of a microsoft entra id role assignable group the activate logs show an error similar to error\ groups\ unable to add user to group \[group] system exception error adding \[user] to group \[group] insufficient privileges to complete the operation microsoft graph models odataerrors odataerror insufficient privileges to complete the operation users may still be added successfully to standard microsoft entra id security groups cause microsoft entra id applies additional security controls to role assignable groups a role assignable group is a security group that can have a microsoft entra administrative role assigned to it users added to the group can therefore inherit the administrative privileges associated with that role role assignable groups have the microsoft graph property isassignabletorole = true because changing the membership of these groups can grant administrative privileges, microsoft does not allow applications to manage their membership using standard group management permissions alone for example, permissions that allow activate to manage standard groups, such as group readwrite all do not provide sufficient privileges to modify the membership of a role assignable group microsoft graph returns insufficient privileges to complete the operation when activate attempts the membership change without the additional role management permission resolution if activate is required to manage membership of role assignable groups, the activate microsoft entra application requires the following microsoft graph application permission rolemanagement readwrite directory administrator consent must also be granted for this permission important rolemanagement readwrite directory is a highly privileged microsoft graph permission it allows the application to perform role management operations within microsoft entra id review the security implications with the customer's identity or security team before granting this permission add the required permission sign in to the microsoft entra admin centre go to identity > applications > app registrations locate the application registration used by activate select api permissions select add a permission select microsoft graph select application permissions locate and select\ rolemanagement readwrite directory select add permissions select grant admin consent for the organisation confirm that the permission shows as granted after granting the permission, retry the group membership operation in activate confirm the group is role assignable if standard groups work but a particular group returns an insufficient privileges error, check whether the affected group is role assignable in microsoft graph, a role assignable group has isassignabletorole true role assignable groups can also be identified in microsoft entra by checking whether the group is configured for microsoft entra role assignment if isassignabletorole = false the issue is not specific to role assignable groups and the application's existing microsoft graph permissions should be investigated instead why standard group permissions are not sufficient microsoft deliberately separates normal group administration from role administration for a standard security group, adding a member grants access associated with that group for a role assignable group, the same operation may indirectly grant a microsoft entra administrative role user ↓ added to role assignable group ↓ group has microsoft entra role ↓ user receives administrative privileges microsoft therefore requires additional role management privileges before an application can modify these memberships security consideration do not grant rolemanagement readwrite directory solely to suppress an insufficient privileges error without first confirming that activate is expected to manage role assignable groups if the customer does not require activate to manage these groups, retaining the existing lower privilege microsoft graph permissions maintains a stronger least privilege configuration