# Aggregation error

**URL:** <https://developer.sailpoint.com/discuss/t/aggregation-error/16885>\
**Category:** SHF Discussion and Questions\
**Tags:** access-requests, aggregation, sailpoint-identity-security\
**Created:** [August 30, 2023, 9:29am UTC](https://developer.sailpoint.com/discuss/t/aggregation-error/16885 "2023-08-30T09:29:00Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jeyanthan](https://avatars.discourse-cdn.com/v4/letter/j/c89c15/32.png) [@jeyanthan](https://developer.sailpoint.com/discuss/u/jeyanthan)\
**Post date:** [August 30, 2023, 9:29am UTC](https://developer.sailpoint.com/discuss/t/aggregation-error/16885/1 "2023-08-30T09:29:00Z")

</div>

Hello,

I’m posting because I’ve had a problem with aggregation with Sailpoint and Azure for several days.  
I would say that it has never worked.

I have deleted all the attributed risk but it still doesn’t work.  
I even recreated the application to make sure there were no errors.

The rights on API permissions are  
Azure Active Directory Graph \> Directory.Read.all

Microsoft Graph \> User.Read

Exception during aggregation of Object Type account on Application “NameOfApplication” Reason: Unable to create iterator sailpoint.connector.ConnectorException: Exception occurred in Iterate Objects. Error message - Exception occurred in processReadRequest. Error - Exception occurred while trying to receive data from Server. Number of retries exceeded.Insufficient privileges to complete the operation.

Thanks for your help

---

<div class="post-metadata">

**Author:** ![ts\_fpatterson](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/ts_fpatterson/32/26704_2.png) [@ts\_fpatterson](https://developer.sailpoint.com/discuss/u/ts_fpatterson)\
**Post date:** [August 31, 2023, 1:22pm UTC](https://developer.sailpoint.com/discuss/t/aggregation-error/16885/2 "2023-08-31T13:22:02Z")

</div>

Your permissions do not seem to be sufficient based on the error and what permissions you have specified.

see: [Required Permissions (sailpoint.com)](https://documentation.sailpoint.com/connectors/microsoft/azure_ad/help/integrating_azure_active_directory/administrator_permission.html)

---

<div class="post-metadata">

**Author:** ![mcheek](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/mcheek/32/23705_2.png) [@mcheek](https://developer.sailpoint.com/discuss/u/mcheek)\
**Post date:** [August 31, 2023, 4:36pm UTC](https://developer.sailpoint.com/discuss/t/aggregation-error/16885/3 "2023-08-31T16:36:39Z")

</div>

If you are planning to [aggregate Service Principals](https://documentation.sailpoint.com/connectors/microsoft/azure_ad/help/integrating_azure_active_directory/service_principal_account_mgmt.html), at a minimum you need Application.Read.All.

If you don’t want to aggregate service principals as accounts, then you need to turn that off using [feature management](https://documentation.sailpoint.com/connectors/microsoft/azure_ad/help/integrating_azure_active_directory/manage_service_principals.html)

---

<div class="post-metadata">

**Author:** ![ryan\_polzen](https://avatars.discourse-cdn.com/v4/letter/r/46a35a/32.png) [@ryan\_polzen](https://developer.sailpoint.com/discuss/u/ryan_polzen)\
**Post date:** [September 1, 2023, 6:42pm UTC](https://developer.sailpoint.com/discuss/t/aggregation-error/16885/4 "2023-09-01T18:42:17Z")

</div>

Not sure if your question was completely answered yet but based on our own Azure AD connection we have the following permissions for the API.

Microsoft Graph \> Application.Read.All, AppRoleAssignment.ReadWrite.All, Group.Read.All, GroupReadWrite.All, IdentityRiskEvent.Read.All, IdentityRiskyUser.Read.All, Organization.Read.All, RoleManagement.Read.Write.Directory, User.Invite.All, User.Read, User.Read.All and User.ReadWrite.All.

Now to be fair, I did inherit this configuration and didn’t setup the connection myself so some of these might be redundant or unneeded but this is what we have configured and I haven’t had any aggregation errors with Azure yet.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [October 31, 2023, 6:43pm UTC](https://developer.sailpoint.com/discuss/t/aggregation-error/16885/5 "2023-10-31T18:43:03Z")

</div>

Closed on October 31, 2023, 6:43pm UTC

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.