Unauthorized - 401 on powershell and graph explorer

[thiagogbeier]

Is anyone else having issues authenticating graph API

on graph explorer
https://graph.microsoft.com/v1.0//deviceManagement/managedDevices/

logged as global admin

permissions consented
DeviceManagementManagedDevices.Read.All
DeviceManagementConfiguration.Read.All
DeviceManagementConfiguration.ReadWrite.All
DeviceManagementManagedDevices.ReadWrite.All

error
{
"error": {
"code": "UnknownError",
"message": "{"ErrorCode":"Forbidden","Message":"{\r\n \"_version\": 3,\r\n \"Message\": \"An error has occurred - Operation ID (for customer support): 00000000-0000-0000-0000-000000000000 - Activity ID: 69f89bd0-877a-faa4-3866-44d8d89438ca - Url: https://fef.amsua0602.manage.microsoft.com/DeviceFE/StatelessDeviceFEService/deviceManagement/managedDevices?api-version=2023-10-19\\\",\\r\\n \"CustomApiErrorPhrase\": \"\",\r\n \"RetryAfter\": null,\r\n \"ErrorSourceService\": \"\",\r\n \"HttpHeaders\": \"{\\\"WWW-Authenticate\\\":\\\"Bearer\\\"}\"\r\n}","Target":null,"Details":null,"InnerError":null,"InstanceAnnotations":[]}",
"innerError": {
"date": "2024-10-18T18:04:58",
"request-id": "8550d6dd-f6f7-4a7b-bbb2-d18a99c1c1ed",
"client-request-id": "69f89bd0-877a-faa4-3866-44d8d89438ca"
}
}
}

response headers
{
"client-request-id": "69f89bd0-877a-faa4-3866-44d8d89438ca",
"content-type": "application/json",
"request-id": "8550d6dd-f6f7-4a7b-bbb2-d18a99c1c1ed"
}

same error with
Import-Module Microsoft.Graph.DeviceManagement
Get-MgDeviceManagementManagedDevice

#powershell automation is broken

Get-MgDeviceManagementWindowsAutopilotDeviceIdentity : {"ErrorCode":"Forbidden","Message":"{\r\n "_version": 3,\r\n "Message": "An error has occurred - Operation ID (for
customer support): 00000000-0000-0000-0000-000000000000 - Activity ID: 1ae0fe62-b10a-45b2-a8ca-3952cb2c9a30 - Url:
https://fef.amsua0602.manage.microsoft.com/DeviceEnrollmentFE/StatelessDeviceEnrollmentFEService/deviceManagement/windowsAutopilotDeviceIdentities?api-version=2024-03-21\",\r\n
"CustomApiErrorPhrase": "",\r\n "RetryAfter": null,\r\n "ErrorSourceService": "",\r\n "HttpHeaders":
"{\"WWW-Authenticate\":\"Bearer\"}"\r\n}","Target":null,"Details":null,"InnerError":null,"InstanceAnnotations":[]}
Status: 401 (Unauthorized)
ErrorCode: UnknownError
Date: 2024-10-18T17:53:32
Headers:
Transfer-Encoding : chunked
Vary : Accept-Encoding
Strict-Transport-Security : max-age=31536000
request-id : 864f60a5-43cf-4123-87e8-734b082aeccc
client-request-id : 1ae0fe62-b10a-45b2-a8ca-3952cb2c9a30
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"Canada Central","Slice":"E","Ring":"3","ScaleUnit":"000","RoleInstance":"TO1PEPF00006AD3"}}
Date : Fri, 18 Oct 2024 17:53:31 GMT
At C:\Temp\PSH\1\Scripts\Mismatch-ENTRA-ADDS-INTUNE-WinAutoPilot.ps1:26 char:5

• **$global:autopilotDevices = (Get-MgDeviceManagementWindowsAutopilo** ...
  

• ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : InvalidOperation: ({ Top = , Skip ... , Headers = }:<>f__AnonymousType6`9) [Get-MgDeviceMan...ceIdentity_List], Exception
  • FullyQualifiedErrorId : UnknownError,Microsoft.Graph.PowerShell.Cmdlets.GetMgDeviceManagementWindowsAutopilotDeviceIdentity_List
    Get-MgDeviceManagementManagedDevice : {"ErrorCode":"Forbidden","Message":"{\r\n "_version": 3,\r\n "Message": "An error has occurred - Operation ID (for customer support):
    00000000-0000-0000-0000-000000000000 - Activity ID: b1939a2f-ee74-4cc6-9acb-f2c87bed9b69 - Url:
    https://fef.amsua0602.manage.microsoft.com/DeviceFE/StatelessDeviceFEService/deviceManagement/managedDevices?api-version=2023-10-19\",\r\n "CustomApiErrorPhrase": "",\r\n
    "RetryAfter": null,\r\n "ErrorSourceService": "",\r\n "HttpHeaders":
    "{\"WWW-Authenticate\":\"Bearer\"}"\r\n}","Target":null,"Details":null,"InnerError":null,"InstanceAnnotations":[]}
    Status: 401 (Unauthorized)
    ErrorCode: UnknownError
    Date: 2024-10-18T17:53:33
    Headers:
    Transfer-Encoding : chunked
    Vary : Accept-Encoding
    Strict-Transport-Security : max-age=31536000
    request-id : b71f6590-7150-4d29-9d64-c07775597e0b
    client-request-id : b1939a2f-ee74-4cc6-9acb-f2c87bed9b69
    x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"Canada Central","Slice":"E","Ring":"3","ScaleUnit":"000","RoleInstance":"TO1PEPF00006AD3"}}
    Date : Fri, 18 Oct 2024 17:53:32 GMT
    At C:\Temp\PSH\1\Scripts\Mismatch-ENTRA-ADDS-INTUNE-WinAutoPilot.ps1:29 char:5

• $global:intuneDevices = Get-MgDeviceManagementManagedDevice -All
  

• ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : InvalidOperation: ({ Top = , Skip ... , Headers = }:<>f__AnonymousType7`9) [Get-MgDeviceManagementManagedDevice_List], Exception
  • FullyQualifiedErrorId : UnknownError,Microsoft.Graph.PowerShell.Cmdlets.GetMgDeviceManagementManagedDevice_List

started 10/18/2025 past 12:15 AM EST

[AntonWilloughby]

Try adding these scopes:

DeviceManagementServiceConfig.ReadWrite.All, DeviceManagementServiceConfig.Read.All

Source:
(Find-MgGraphCommand Get-MgDeviceManagementWindowsAutopilotDeviceIdentity).Permissions | select Name, Description | ft

[thiagogbeier]

thanks for the heads up
reviewed the entire ps1 files
updated permissions adding readwrite.all EVEN knowing that's not required for my PS1 to run
on windows sandbox (fresh) nothing installed same ERRORs
install modules, import modules, fails running commands (commands are found)

Starting gathering data
import-csv : Could not find a part of the path 'C:\Users\Thiago Beier\Downloads\workplacedudes\exports\adds-devices-letsintune-light.csv'.
At C:\temp\1\Scripts\Mismatch-ENTRA-ADDS-INTUNE-WinAutoPilot.ps1:25 char:27

• ... dsDevices = import-csv "C:\Users\Thiago Beier\Downloads\workplacedude ...

•             ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : OpenError: (:) [Import-Csv], DirectoryNotFoundException
  • FullyQualifiedErrorId : FileOpenFailure,Microsoft.PowerShell.Commands.ImportCsvCommand

Get-MgDeviceManagementWindowsAutopilotDeviceIdentity : {"ErrorCode":"Forbidden","Message":"{\r\n "_version": 3,\r\n "Message": "An error has occurred - Operation ID (for customer support):
00000000-0000-0000-0000-000000000000 - Activity ID: ad09db83-85c2-4616-b937-16a0a3d9af03 - Url:
https://fef.amsua0602.manage.microsoft.com/DeviceEnrollmentFE/StatelessDeviceEnrollmentFEService/deviceManagement/windowsAutopilotDeviceIdentities?api-version=2024-03-21\",\r\n "CustomApiErrorPhrase": "",\r\n
"RetryAfter": null,\r\n "ErrorSourceService": "",\r\n "HttpHeaders": "{\"WWW-Authenticate\":\"Bearer\"}"\r\n}","Target":null,"Details":null,"InnerError":null,"InstanceAnnotations":[]}
Status: 401 (Unauthorized)
ErrorCode: UnknownError
Date: 2024-10-18T19:59:33
Headers:
Transfer-Encoding : chunked
Vary : Accept-Encoding
Strict-Transport-Security : max-age=31536000
request-id : 404c2a9b-5c15-40c7-8f54-f840112c64e9
client-request-id : ad09db83-85c2-4616-b937-16a0a3d9af03
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"Canada Central","Slice":"E","Ring":"3","ScaleUnit":"002","RoleInstance":"YT2PEPF000001D9"}}
Date : Fri, 18 Oct 2024 19:59:32 GMT
At C:\temp\1\Scripts\Mismatch-ENTRA-ADDS-INTUNE-WinAutoPilot.ps1:26 char:5

• $global:autopilotDevices = (Get-MgDeviceManagementWindowsAutopilo ...
  

• ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : InvalidOperation: ({ Top = , Skip ... , Headers = }:<>f__AnonymousType6`9) [Get-MgDeviceMan...ceIdentity_List], Exception
  • FullyQualifiedErrorId : UnknownError,Microsoft.Graph.PowerShell.Cmdlets.GetMgDeviceManagementWindowsAutopilotDeviceIdentity_List
    Get-MgDeviceManagementManagedDevice : {"ErrorCode":"Forbidden","Message":"{\r\n "_version": 3,\r\n "Message": "An error has occurred - Operation ID (for customer support): 00000000-0000-0000-0000-000000000000

• Activity ID: 873c47cf-2bc3-4460-ba07-22b80aabc57d - Url: https://fef.amsua0602.manage.microsoft.com/DeviceFE/StatelessDeviceFEService/deviceManagement/managedDevices?api-version=2023-10-19\",\r\n
  "CustomApiErrorPhrase": "",\r\n "RetryAfter": null,\r\n "ErrorSourceService": "",\r\n "HttpHeaders":
  "{\"WWW-Authenticate\":\"Bearer\"}"\r\n}","Target":null,"Details":null,"InnerError":null,"InstanceAnnotations":[]}
  Status: 401 (Unauthorized)
  ErrorCode: UnknownError
  Date: 2024-10-18T19:59:33
  Headers:
  Transfer-Encoding : chunked
  Vary : Accept-Encoding
  Strict-Transport-Security : max-age=31536000
  request-id : d37a5007-e62d-42d1-b161-2bd7b2d6bff5
  client-request-id : 873c47cf-2bc3-4460-ba07-22b80aabc57d
  x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"Canada Central","Slice":"E","Ring":"3","ScaleUnit":"002","RoleInstance":"YT2PEPF000001D9"}}
  Date : Fri, 18 Oct 2024 19:59:33 GMT
  At C:\temp\1\Scripts\Mismatch-ENTRA-ADDS-INTUNE-WinAutoPilot.ps1:29 char:5

• $global:intuneDevices = Get-MgDeviceManagementManagedDevice -All
  

• ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : InvalidOperation: ({ Top = , Skip ... , Headers = }:<>f__AnonymousType7`9) [Get-MgDeviceManagementManagedDevice_List], Exception
  • FullyQualifiedErrorId : UnknownError,Microsoft.Graph.PowerShell.Cmdlets.GetMgDeviceManagementManagedDevice_List

[thiagogbeier]

hello everyone
we crated the same settings on client TENANT in Brazil (worked)
couldn't validate North America however, it seems CDX tenants affected not gov/business
as I have mimic client's environment no CDX and it's down will have to work on ps1 files without real data but exports from portal (csv files mimicking the "arrays" from get-commands to make sure logic is fine till CDX is back online.

[thiagogbeier]

CDX tenant related issue
was able to test on Brazil tenant working as expected
stopped working 10/18/2024 12:15 AM EST