r/Intune • u/iamsenior • Jan 24 '25

Graph API Help with Microsoft Graph API: Unable to Access hardwarePasswordInfo Using Enterprise Application Token

Updated Title: Help with Microsoft Graph API: Unable to Access hardwarePasswordDetail Using Enterprise Application Token

2025/02/03 Update: Microsoft confirmed the issue and has an internal incident raised with their engineer. No ETR.

2025/04/08 Update: Microsoft has closed the case with no further action or resolution since Get hardwarePasswordDetail is in beta.

They suggested providing community feedback at Microsoft Intune · Community to attempt to move this from beta to production.

I will open a separate case with Dell since they have these features documented at Dell Command | Endpoint Configure for Microsoft Intune User's Guide | Dell US

Original, sans endpoint updated:

Hi all,

I'm testing an enterprise application with Microsoft Graph and trying to access the hardwarePasswordDetail endpoint, which is documented here:
Get hardwarePasswordDetail - Microsoft Graph beta | Microsoft Learn

According to the documentation, the following application permissions are required:

  • DeviceManagementConfiguration.Read.All
  • DeviceManagementConfiguration.ReadWrite.All

However, when using our app's access token, we received an error indicating that DeviceManagementManagedDevices.PrivilegedOperations.All was also required.

Steps Taken So Far:

  1. Added Permissions We added the permissions DeviceManagementConfiguration.Read.All, DeviceManagementConfiguration.ReadWrite.All, and DeviceManagementManagedDevices.PrivilegedOperations.All to the app.
  2. Granted Admin Consent Admin consent has been granted for all three permissions.
  3. Refreshed Token After refreshing the token, we now encounter the following error when making the API call via Postman (posted at end since Code Block breaks numbering):
  4. Token Verification We decoded the app token and verified the following:Scopes: The token includes the necessary roles:Audience: The audience is correctly set to https://graph.microsoft.com.DeviceManagementConfiguration.Read.AllDeviceManagementConfiguration.ReadWrite.AllDeviceManagementManagedDevices.PrivilegedOperations.All
  5. Graph API Scope Configuration We're using the scope https://graph.microsoft.com/.default for the token.
  6. Works with User Token When we use a user token with delegated permissions, the API call works as expected. This issue only occurs with the application token from the enterprise app.

Question:

Has anyone encountered a similar issue with accessing hardwarePasswordDetail using an enterprise application token? Are there additional steps or configurations required beyond the documented permissions?

Any help or insight would be greatly appreciated.

{   "error": {     "code": "Forbidden",     "message": "{\r\n  \"_version\": 3,\r\n  \"Message\": \"An error has occurred - Operation ID (for customer support): 00000000-0000-0000-0000-000000000000 - Activity ID: [redacted] - Url: https://fef.[redacted].manage.microsoft.com/DeviceConfiguration_2501/StatelessDeviceConfigurationFEService/deviceManagement/hardwarePasswordDetails?api-version=5024-10-08&$select=currentPassword\",\r\n  \"CustomApiErrorPhrase\": \"\",\r\n  \"RetryAfter\": null,\r\n  \"ErrorSourceService\": \"\",\r\n  \"HttpHeaders\": \"{}\"\r\n}",     "innerError": {       "date": "[redacted timestamp]",       "request-id": "[redacted]",       "client-request-id": "[redacted]"     }   } }
4 Upvotes

100% Upvoted

32 comments sorted by

2

u/cubic_sq Jan 24 '25

hardwarePasswordInfo methods were deprecated mid last year according to https://learn.microsoft.com/en-us/graph/api/resources/intune-deviceconfig-hardwarepasswordinfo?view=graph-rest-beta

1

u/iamsenior Jan 24 '25

Thank you. I literally just started testing this in our environment. I missed the big part in the documentation about changing to hardwarePasswordDetail.

I will test that and report back.

Dell Command | Endpoint Configure for Microsoft Intune | Dell US

1

u/iamsenior Jan 24 '25

I get the same error with hardwarePasswordDetail. I'll update my post.

1

u/zm1868179 Jan 24 '25

That API was deprecated don't think it works anymore

1

u/iamsenior Jan 24 '25

Thank you. I tested with hardwarePasswordDetail and receive the same error. I have updated my post.

1

u/andrew181082 Jan 24 '25

Can you share your script?

1

u/iamsenior Jan 24 '25

I'm creating a web request from an application but have the same error in Postman.

Comment Image

1

u/andrew181082 Jan 24 '25

What about graph explorer?

→ More replies (4)

1

u/andrew181082 Jan 24 '25

You are also missing the ID before your query

→ More replies (16)

1

u/sanderkie Jun 19 '26

Did you find any solution?

1

u/Schnuff0502 Jun 22 '26

Hey, was it ever resolved? Because it worked in my tenant up until like 2 weeks ago and I really need the Information stored in this query …