Insufficient privileges to complete the operation while invoking Get-AzADGroupMember - azure

Question

I have an Azure function in Powershell(v 2.0) with Az Module Installed and an assigned managed identity to manage resources within a bunch of subscriptions for a tenant say 'A'. Because of which I have been able to perform operations to handle VM/subscriptions management with commands like Get-AzVm, Set-AzContext etc.
In the function, there is a logic to check if a user is present within an Usergroup say 'readonlygroup' in AzureAD for tenant 'A'. And I'm trying to get the usergroup from the function by calling
$users = Get-AzADGroupMember -GroupDisplayName 'readonlygroup'
But I get an exception thrown
ERROR: Get-AzADGroupMember : Insufficient privileges to complete the operation.
At D:\home\site\wwwroot\{functionname}\run.ps1:110 char:18
+ ... $users = Get-AzADGroupMember -GroupDisplayName 'readonlygroup'
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [Get-AzADGroupMember], Exception
+ FullyQualifiedErrorId : Microsoft.Azure.Commands.ActiveDirectory.GetAzureADGroupMemberCommand
Script stack trace:
at <ScriptBlock>, D:\home\site\wwwroot\{functionname}\run.ps1: line 110
System.Exception: Insufficient privileges to complete the operation.
I'm assuming its because the identity associated with the Function app doesn't have appropriate access to Azure Active directory. I was able to assign role assignments to the app identity to manage subscriptions but I don't see any options on how to setup a similar configuration to access AD from function app.
How can I run this command from my azure powershell function?

Answer 1

Try going to your azure ad, roles and administrators, choose a role that allows you to perform the ps functions you want, in this case you are trying to read groups, so maybe directory readers then click add assignments. find your function name, or from the function app identity blade, copy the object id shown, then paste it in the add assignments searchbox, it should find it, add it there.. may take up to 24 hrs to take effect but usually much quicker, then you should be able to run those ps commands.
the azure role assignments you added from the identity blade in the function only gives it for example subscription access, not access to azure ad.