Troubleshooting Microsoft Azure - "Graph client: Insufficient privileges to complete the operation" error
This article explains what to do if you encounter "Graph client: Insufficient privileges to complete the operation." while connecting to Azure.
Table of Contents
Step-by-step guide
If you see the error message "Graph client: Insufficient privileges to complete the operation." when connecting to Azure, do the following:
- Open the Azure Portal
- Click Azure Active Directory
- Click App registrations in the left bar
- Click the app you registered for Checkmk
- Click API permissions in the left bar
- Click Add Permissions and add a permissions for Microsoft Graph
Full list of access rights needed:
| API & Use | Documentation |
|---|---|
| Get Metric data | https://docs.microsoft.com/en-us/rest/api/monitor/metrics/list |
| get resources | https://docs.microsoft.com/en-us/rest/api/resources/operations%20(resources)/list |
| get resource groups | https://docs.microsoft.com/en-us/rest/api/resources/resource-groups/list |
| consumption details | https://docs.microsoft.com/en-us/rest/api/consumption/usage-details/list |
| VM info | https://docs.microsoft.com/en-us/rest/api/compute/virtual-machines/instance-view |
| Active Directory top users | https://docs.microsoft.com/en-us/graph/api/user-list?view=graph-rest-1.0&tabs=http |
| Active Directory organizations | https://docs.microsoft.com/en-us/graph/api/intune-onboarding-organization-list?view=graph-rest-1.0 |
These are the metrics we get via the Azure agents
| Resource URI | Metric name |
|---|---|
| Microsoft.Network/virtualNetworkGateways | AverageBandwidth,P2SBandwidth |
| Microsoft.Sql/servers/databases | storage_percent,deadlock,cpu_percent,dtu_consumption_percent,connection_successful,connection_failed |
| Microsoft.Storage/storageAccounts | UsedCapacity,Ingress,Egress,Transactions,SuccessServerLatency,SuccessE2ELatency,Availability |
| Microsoft.Web/sites | CpuTime,AverageResponseTime,Http5xx |
Related articles