Unauthorized - 401 on powershell and graph explorer #3003

thiagogbeier · 2024-10-18T18:11:55Z

thiagogbeier
Oct 18, 2024

Is anyone else having issues authenticating graph API

on graph explorer
https://graph.microsoft.com/v1.0//deviceManagement/managedDevices/

logged as global admin

permissions consented
DeviceManagementManagedDevices.Read.All
DeviceManagementConfiguration.Read.All
DeviceManagementConfiguration.ReadWrite.All
DeviceManagementManagedDevices.ReadWrite.All

error
{
"error": {
"code": "UnknownError",
"message": "{"ErrorCode":"Forbidden","Message":"{\r\n \"_version\": 3,\r\n \"Message\": \"An error has occurred - Operation ID (for customer support): 00000000-0000-0000-0000-000000000000 - Activity ID: 69f89bd0-877a-faa4-3866-44d8d89438ca - Url: https://fef.amsua0602.manage.microsoft.com/DeviceFE/StatelessDeviceFEService/deviceManagement/managedDevices?api-version=2023-10-19\\\",\\r\\n \"CustomApiErrorPhrase\": \"\",\r\n \"RetryAfter\": null,\r\n \"ErrorSourceService\": \"\",\r\n \"HttpHeaders\": \"{\\\"WWW-Authenticate\\\":\\\"Bearer\\\"}\"\r\n}","Target":null,"Details":null,"InnerError":null,"InstanceAnnotations":[]}",
"innerError": {
"date": "2024-10-18T18:04:58",
"request-id": "8550d6dd-f6f7-4a7b-bbb2-d18a99c1c1ed",
"client-request-id": "69f89bd0-877a-faa4-3866-44d8d89438ca"
}
}
}

response headers
{
"client-request-id": "69f89bd0-877a-faa4-3866-44d8d89438ca",
"content-type": "application/json",
"request-id": "8550d6dd-f6f7-4a7b-bbb2-d18a99c1c1ed"
}

same error with
Import-Module Microsoft.Graph.DeviceManagement
Get-MgDeviceManagementManagedDevice

#powershell automation is broken

Get-MgDeviceManagementWindowsAutopilotDeviceIdentity : {"ErrorCode":"Forbidden","Message":"{\r\n "_version": 3,\r\n "Message": "An error has occurred - Operation ID (for
customer support): 00000000-0000-0000-0000-000000000000 - Activity ID: 1ae0fe62-b10a-45b2-a8ca-3952cb2c9a30 - Url:
https://fef.amsua0602.manage.microsoft.com/DeviceEnrollmentFE/StatelessDeviceEnrollmentFEService/deviceManagement/windowsAutopilotDeviceIdentities?api-version=2024-03-21\",\r\n
"CustomApiErrorPhrase": "",\r\n "RetryAfter": null,\r\n "ErrorSourceService": "",\r\n "HttpHeaders":
"{\"WWW-Authenticate\":\"Bearer\"}"\r\n}","Target":null,"Details":null,"InnerError":null,"InstanceAnnotations":[]}
Status: 401 (Unauthorized)
ErrorCode: UnknownError
Date: 2024-10-18T17:53:32
Headers:
Transfer-Encoding : chunked
Vary : Accept-Encoding
Strict-Transport-Security : max-age=31536000
request-id : 864f60a5-43cf-4123-87e8-734b082aeccc
client-request-id : 1ae0fe62-b10a-45b2-a8ca-3952cb2c9a30
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"Canada Central","Slice":"E","Ring":"3","ScaleUnit":"000","RoleInstance":"TO1PEPF00006AD3"}}
Date : Fri, 18 Oct 2024 17:53:31 GMT
At C:\Temp\PSH\1\Scripts\Mismatch-ENTRA-ADDS-INTUNE-WinAutoPilot.ps1:26 char:5

**$global:autopilotDevices = (Get-MgDeviceManagementWindowsAutopilo** ...

```
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
```
- CategoryInfo : InvalidOperation: ({ Top = , Skip ... , Headers = }:<>f__AnonymousType6`9) [Get-MgDeviceMan...ceIdentity_List], Exception
- FullyQualifiedErrorId : UnknownError,Microsoft.Graph.PowerShell.Cmdlets.GetMgDeviceManagementWindowsAutopilotDeviceIdentity_List
  Get-MgDeviceManagementManagedDevice : {"ErrorCode":"Forbidden","Message":"{\r\n "_version": 3,\r\n "Message": "An error has occurred - Operation ID (for customer support):
  00000000-0000-0000-0000-000000000000 - Activity ID: b1939a2f-ee74-4cc6-9acb-f2c87bed9b69 - Url:
  https://fef.amsua0602.manage.microsoft.com/DeviceFE/StatelessDeviceFEService/deviceManagement/managedDevices?api-version=2023-10-19\",\r\n "CustomApiErrorPhrase": "",\r\n
  "RetryAfter": null,\r\n "ErrorSourceService": "",\r\n "HttpHeaders":
  "{\"WWW-Authenticate\":\"Bearer\"}"\r\n}","Target":null,"Details":null,"InnerError":null,"InstanceAnnotations":[]}
  Status: 401 (Unauthorized)
  ErrorCode: UnknownError
  Date: 2024-10-18T17:53:33
  Headers:
  Transfer-Encoding : chunked
  Vary : Accept-Encoding
  Strict-Transport-Security : max-age=31536000
  request-id : b71f6590-7150-4d29-9d64-c07775597e0b
  client-request-id : b1939a2f-ee74-4cc6-9acb-f2c87bed9b69
  x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"Canada Central","Slice":"E","Ring":"3","ScaleUnit":"000","RoleInstance":"TO1PEPF00006AD3"}}
  Date : Fri, 18 Oct 2024 17:53:32 GMT
  At C:\Temp\PSH\1\Scripts\Mismatch-ENTRA-ADDS-INTUNE-WinAutoPilot.ps1:29 char:5

$global:intuneDevices = Get-MgDeviceManagementManagedDevice -All

```
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
```
- CategoryInfo : InvalidOperation: ({ Top = , Skip ... , Headers = }:<>f__AnonymousType7`9) [Get-MgDeviceManagementManagedDevice_List], Exception
- FullyQualifiedErrorId : UnknownError,Microsoft.Graph.PowerShell.Cmdlets.GetMgDeviceManagementManagedDevice_List

started 10/18/2025 past 12:15 AM EST

AntonWilloughby · 2024-10-18T19:16:12Z

AntonWilloughby
Oct 18, 2024

Try adding these scopes:

DeviceManagementServiceConfig.ReadWrite.All, DeviceManagementServiceConfig.Read.All

Source:
(Find-MgGraphCommand Get-MgDeviceManagementWindowsAutopilotDeviceIdentity).Permissions | select Name, Description | ft

1 reply

thiagogbeier Oct 18, 2024
Author

thanks for the heads up
reviewed the entire ps1 files
updated permissions adding readwrite.all EVEN knowing that's not required for my PS1 to run
on windows sandbox (fresh) nothing installed same ERRORs
install modules, import modules, fails running commands (commands are found)

Starting gathering data
import-csv : Could not find a part of the path 'C:\Users\Thiago Beier\Downloads\workplacedudes\exports\adds-devices-letsintune-light.csv'.
At C:\temp\1\Scripts\Mismatch-ENTRA-ADDS-INTUNE-WinAutoPilot.ps1:25 char:27

... dsDevices = import-csv "C:\Users\Thiago Beier\Downloads\workplacedude ...
```
            ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
```
- CategoryInfo : OpenError: (:) [Import-Csv], DirectoryNotFoundException
- FullyQualifiedErrorId : FileOpenFailure,Microsoft.PowerShell.Commands.ImportCsvCommand

Get-MgDeviceManagementWindowsAutopilotDeviceIdentity : {"ErrorCode":"Forbidden","Message":"{\r\n "_version": 3,\r\n "Message": "An error has occurred - Operation ID (for customer support):
00000000-0000-0000-0000-000000000000 - Activity ID: ad09db83-85c2-4616-b937-16a0a3d9af03 - Url:
https://fef.amsua0602.manage.microsoft.com/DeviceEnrollmentFE/StatelessDeviceEnrollmentFEService/deviceManagement/windowsAutopilotDeviceIdentities?api-version=2024-03-21\",\r\n "CustomApiErrorPhrase": "",\r\n
"RetryAfter": null,\r\n "ErrorSourceService": "",\r\n "HttpHeaders": "{\"WWW-Authenticate\":\"Bearer\"}"\r\n}","Target":null,"Details":null,"InnerError":null,"InstanceAnnotations":[]}
Status: 401 (Unauthorized)
ErrorCode: UnknownError
Date: 2024-10-18T19:59:33
Headers:
Transfer-Encoding : chunked
Vary : Accept-Encoding
Strict-Transport-Security : max-age=31536000
request-id : 404c2a9b-5c15-40c7-8f54-f840112c64e9
client-request-id : ad09db83-85c2-4616-b937-16a0a3d9af03
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"Canada Central","Slice":"E","Ring":"3","ScaleUnit":"002","RoleInstance":"YT2PEPF000001D9"}}
Date : Fri, 18 Oct 2024 19:59:32 GMT
At C:\temp\1\Scripts\Mismatch-ENTRA-ADDS-INTUNE-WinAutoPilot.ps1:26 char:5

$global:autopilotDevices = (Get-MgDeviceManagementWindowsAutopilo ...

```
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
```
- CategoryInfo : InvalidOperation: ({ Top = , Skip ... , Headers = }:<>f__AnonymousType6`9) [Get-MgDeviceMan...ceIdentity_List], Exception
- FullyQualifiedErrorId : UnknownError,Microsoft.Graph.PowerShell.Cmdlets.GetMgDeviceManagementWindowsAutopilotDeviceIdentity_List
  Get-MgDeviceManagementManagedDevice : {"ErrorCode":"Forbidden","Message":"{\r\n "_version": 3,\r\n "Message": "An error has occurred - Operation ID (for customer support): 00000000-0000-0000-0000-000000000000

Activity ID: 873c47cf-2bc3-4460-ba07-22b80aabc57d - Url: https://fef.amsua0602.manage.microsoft.com/DeviceFE/StatelessDeviceFEService/deviceManagement/managedDevices?api-version=2023-10-19\",\r\n
"CustomApiErrorPhrase": "",\r\n "RetryAfter": null,\r\n "ErrorSourceService": "",\r\n "HttpHeaders":
"{\"WWW-Authenticate\":\"Bearer\"}"\r\n}","Target":null,"Details":null,"InnerError":null,"InstanceAnnotations":[]}
Status: 401 (Unauthorized)
ErrorCode: UnknownError
Date: 2024-10-18T19:59:33
Headers:
Transfer-Encoding : chunked
Vary : Accept-Encoding
Strict-Transport-Security : max-age=31536000
request-id : d37a5007-e62d-42d1-b161-2bd7b2d6bff5
client-request-id : 873c47cf-2bc3-4460-ba07-22b80aabc57d
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"Canada Central","Slice":"E","Ring":"3","ScaleUnit":"002","RoleInstance":"YT2PEPF000001D9"}}
Date : Fri, 18 Oct 2024 19:59:33 GMT
At C:\temp\1\Scripts\Mismatch-ENTRA-ADDS-INTUNE-WinAutoPilot.ps1:29 char:5

$global:intuneDevices = Get-MgDeviceManagementManagedDevice -All

```
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
```
- CategoryInfo : InvalidOperation: ({ Top = , Skip ... , Headers = }:<>f__AnonymousType7`9) [Get-MgDeviceManagementManagedDevice_List], Exception
- FullyQualifiedErrorId : UnknownError,Microsoft.Graph.PowerShell.Cmdlets.GetMgDeviceManagementManagedDevice_List

thiagogbeier · 2024-10-18T21:25:13Z

thiagogbeier
Oct 18, 2024
Author

hello everyone
we crated the same settings on client TENANT in Brazil (worked)
couldn't validate North America however, it seems CDX tenants affected not gov/business
as I have mimic client's environment no CDX and it's down will have to work on ps1 files without real data but exports from portal (csv files mimicking the "arrays" from get-commands to make sure logic is fine till CDX is back online.

0 replies

thiagogbeier · 2024-10-18T21:25:54Z

thiagogbeier
Oct 18, 2024
Author

CDX tenant related issue
was able to test on Brazil tenant working as expected
stopped working 10/18/2024 12:15 AM EST

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Unauthorized - 401 on powershell and graph explorer #3003

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 3 comments 1 reply

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Unauthorized - 401 on powershell and graph explorer #3003

Uh oh!

Uh oh!

thiagogbeier Oct 18, 2024

Replies: 3 comments · 1 reply

Uh oh!

AntonWilloughby Oct 18, 2024

Uh oh!

thiagogbeier Oct 18, 2024 Author

Uh oh!

thiagogbeier Oct 18, 2024 Author

Uh oh!

thiagogbeier Oct 18, 2024 Author

thiagogbeier
Oct 18, 2024

Replies: 3 comments 1 reply

AntonWilloughby
Oct 18, 2024

thiagogbeier Oct 18, 2024
Author

thiagogbeier
Oct 18, 2024
Author

thiagogbeier
Oct 18, 2024
Author