401 access to Microsoft Graph

[aaronparker]

I've struck the following error in a new tenant and scratching my head. The app registration is good and authenticates OK, but has issues access the APIs. Anyone have ideas?

aaron@einstein % IntuneCD-startbackup --mode=1 --output=json --path="$PWD/prod-backup" --localauth="$PWD/auth.json"
Traceback (most recent call last):
  File "/opt/homebrew/bin/IntuneCD-startbackup", line 8, in <module>
    sys.exit(start())
  File "/opt/homebrew/lib/python3.9/site-packages/IntuneCD/run_backup.py", line 139, in start
    run_backup(opts.path,opts.output,exclude,token)
  File "/opt/homebrew/lib/python3.9/site-packages/IntuneCD/run_backup.py", line 68, in run_backup
    savebackup(path,output,exclude,token)
  File "/opt/homebrew/lib/python3.9/site-packages/IntuneCD/backup_appConfiguration.py", line 31, in savebackup
    data = makeapirequest(endpoint, token)
  File "/opt/homebrew/lib/python3.9/site-packages/IntuneCD/graph_request.py", line 38, in makeapirequest
    raise Exception('Request failed with ',response.status_code,' - ',
Exception: ('Request failed with ', 401, ' - ', '{"error":{"code":"UnknownError","message":"{\\"ErrorCode\\":\\"Forbidden\\",\\"Message\\":\\"{\\\\r\\\\n  \\\\\\"_version\\\\\\": 3,\\\\r\\\\n  \\\\\\"Message\\\\\\": \\\\\\"An error has occurred - Operation ID (for customer support): 00000000-0000-0000-0000-000000000000 - Activity ID: 5ec3bed9-63d8-4922-bf3a-50156bf818e4 - Url: https://fef.msuc02.manage.microsoft.com/AppLifecycle_2208/StatelessAppMetadataFEService/deviceAppManagement/mobileAppConfigurations?api-version=5022-06-16\\\\\\",\\\\r\\\\n  \\\\\\"CustomApiErrorPhrase\\\\\\": \\\\\\"\\\\\\",\\\\r\\\\n  \\\\\\"RetryAfter\\\\\\": null,\\\\r\\\\n  \\\\\\"ErrorSourceService\\\\\\": \\\\\\"\\\\\\",\\\\r\\\\n  \\\\\\"HttpHeaders\\\\\\": \\\\\\"{\\\\\\\\\\\\\\"WWW-Authenticate\\\\\\\\\\\\\\":\\\\\\\\\\\\\\"Bearer realm=\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\"urn:intune:service,9225b241-44e1-44a8-8bfe-c10e39177505,f0f3c450-59bf-4f0d-b1b2-0ef84ddfe3c7,3e9c57b9-808d-4aa0-9500-4b2d369279e7\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\"\\\\\\\\\\\\\\"}\\\\\\"\\\\r\\\\n}\\",\\"Target\\":null,\\"Details\\":null,\\"InnerError\\":null,\\"InstanceAnnotations\\":[]}","innerError":{"date":"2022-08-04T10:24:18","request-id":"5ec3bed9-63d8-4922-bf3a-50156bf818e4","client-request-id":"5ec3bed9-63d8-4922-bf3a-50156bf818e4"}}}')

[almenscorner]

What are the exact permissions given to the app?

[aaronparker]

DeviceManagementApps.ReadWrite.All
DeviceManagementConfiguration.ReadWrite.All
DeviceManagementServiceConfig.ReadWrite.All
Group.Read.All
User.Read

[almenscorner]

Interesting, are you able to send some screenshots of the app registration, the granted permissions etc?

[aaronparker]

I'll try export the entire app registration via the Graph to get a full listing of properties. There must be something else missing in this tenant, such as admin consent to the Graph PowerShell application.

[almenscorner]

Change the type from delegated to application and try a backup again

[aaronparker]

🤦‍♂️ Thanks. Such a simple miss.

[almenscorner]

We've all done it 😁