getting error message 401 when navigating to Lifecycle Workflows in Entra tenant with Global Admin

Benoit Bourque 0 Reputation points
2025-05-21T23:09:23.0266667+00:00

unable to access the Lifecycle workflows in the Entra Portal, even with global Admin, we suspect it is related to Identity Governance license.

Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
24,687 questions
{count} votes

1 answer

Sort by: Most helpful
  1. Megan Truong 160 Reputation points Independent advisor
    2025-05-23T02:32:58.78+00:00

    Hi @Benoit Bourque Thank you for contacting the Q&A Forum. Regarding your issue, this is likely related to licensing or permissions. These are some common reasons behind the error:

    1. Missing Required License

    Lifecycle Workflows is part of Microsoft Entra ID Governance, which requires one of the following licenses:

    • Microsoft Entra ID Governance
    • Microsoft Entra Suite P2

    The license is assigned to the operations administrators. Without one of these, even a Global Administrator will receive a 401 error when trying to access Lifecycle Workflows.

    1. Expired or Incorrect Permissions

    If you're using an app registration or service principal to access workflows (e.g., via API), the error can also occur if:

    • The client secret has expired.
    • The app lacks required Graph API permissions (like User.Read.All, Group.Read.All).
    • Admin consent has not been granted
    1. Role Limitations

    Even though you're a Global Administrator, if you're accessing via a delegated app or a role with limited scope (like Windows 365 Administrator), you may still get the error message.

    I would suggest these following fixes for you to apply:

    • Verify Licensing
    • Go to Microsoft Entra Admin Center → Billing → Licenses.
    • Ensure your tenant has Microsoft Entra ID Governance or Entra Suite P2 licenses.
    • Assign the license to your user account.
    • Check Access Method

    If you're using a service principal or app, ensure:

    • The client secret is valid.
    • The app has the correct Graph API permissions.
    • Admin consent has been granted.
    • Try a Different Admin Account: If possible, test access with another licensed Global Admin to rule out account-specific issues.

    Kindly let me know if this work for you and please let me know if you have any further question.

    If I have answered your question, please accept this as answer as a token of appreciation and don't forget to give a thumbs up for "Was it helpful"!

    Best regards,
    Megan

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.