I've created an Azure WebJob to update users' profile.

I'd like to do this without providing credentials in the code. I've created a Principal with FullControl permissions to the User Profiles Scope but the job failed because of permissions.

The Code:

string UserAccountName = "i:0#.f|membership|user@tenant.com";
            string tenantAdministrationUrl = "https://tenant-admin.sharepoint.com/";
            Uri siteUri = new Uri(tenantAdministrationUrl);
            string realm = TokenHelper.GetRealmFromTargetUrl(siteUri);
            string accessToken = TokenHelper.GetAppOnlyAccessToken(TokenHelper.SharePointPrincipal, siteUri.Authority, realm).AccessToken;

            using (var clientContext = TokenHelper.GetClientContextWithAccessToken(siteUri.ToString(), accessToken))
            {
                // Get the people manager instance for tenant context
                PeopleManager peopleManager = new PeopleManager(clientContext);

                // Update the AboutMe property for the user using account name.
                peopleManager.SetSingleValueProfileProperty(UserAccountName, "AboutMe", "Update from CSOM");

                clientContext.ExecuteQuery();
            }

The Error:

Unhandled Exception: Microsoft.SharePoint.Client.ServerUnauthorizedAccessException: Access denied. You do not have permission to perform this action or access this resource.

Hi,

According to your description, my understanding is that you want to use Azure WebJob with Office 365 to manipulate user profile property.

Azure webjob will always need credential to authorize with Office 365. If you don't want to provide user credentials in the code snippet, then you can restore the username and password in a xml config file like below:

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
 <startup> 
   <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" />
 </startup>
 <appSettings>
   <add key="SPOAccount" value="admin@contoso.onmicrosoft.com"/>
   <add key="SPOPassword" value="Contoso"/>
 </appSettings>
</configuration>

Then you can get the credential in the Client Object Model like below:

            using (ClientContext context = new ClientContext("https://contoso.sharepoint.com"))
            {
                // Use default authentication mode.
                context.AuthenticationMode = ClientAuthenticationMode.Default;                 
                context.Credentials = new SharePointOnlineCredentials(GetSPOAccountName(), GetSPOSecureStringPassword());

                // Add your CSOM code to perform tasks on your sites and content.

                try
                {
                    List objList = context.Web.Lists.GetByTitle("Docs");
                    context.Load(objList);
                    context.ExecuteQuery();

                    if (objList != null && objList.ItemCount > 0)
                    {
                        Console.WriteLine(objList.Title.ToString() + " has " + objList.ItemCount + " items.");
                    }

                }
                catch (Exception ex)
                {
                    Console.WriteLine("ERROR: " + ex.Message);
                    Console.WriteLine("ERROR: " + ex.Source);
                    Console.WriteLine("ERROR: " + ex.StackTrace);
                    Console.WriteLine("ERROR: " + ex.InnerException);

                }
            }
                
        }

 private static SecureString GetSPOSecureStringPassword()
  {
      try
      {
          Console.WriteLine("Entered GetSPOSecureStringPassword.");
          var secureString = new SecureString();
          foreach (char c in ConfigurationManager.AppSettings["SPOPassword"])
          {
              secureString.AppendChar(c);
          }
          Console.WriteLine("Constructed the secure password.");

          return secureString;
      }
      catch
      {
          throw;
      }
  }

  private static string GetSPOAccountName()
  {
      try
      {
          Console.WriteLine("Entered GetSPOAccountName.");
          return ConfigurationManager.AppSettings["SPOAccount"];
      }
      catch
      {
          throw;
      }
   }

Here is a detailed article for your reference:

Use Microsoft Azure WebJobs with Office 365

Thanks

Best Regards