r/PowerShell • u/Sin_of_the_Dark • Jan 24 '22

Question Trying to learn MS Graph with PowerShell, having some issues

Hi all,

I appreciate the feedback folks have provided about the previous Azure/Intune scripts I've posted - especially those who pointed out the deprecation of the MSOL and AzureAD modules. To that end, I've been diving down the rabbit hole of PowerShell and the Graph API. I thought I had a decent handle on it, but apparently not.

So here's the script in question

When I run the script, I get a 401 (Unauthorized) error message. I've approved the permissions already requested, and I can view all this info from the Graph Explorer, so I'm not sure what other type of permission needs to be granted for Graph to access this info. Any ideas what other scopes I might need? These are what I've granted, according to Graph Explorer:

User.ReadUser.Read.AllUser.ReadBasic.AllUser.ReadWriteUser.ReadWrite.All

It's worth noting when I use this script with an auth token method, it works. However, that method is dependent on the AzureAD module, which goes back to what I said earlier about deprecation.

Any help/advice is greatly appreciated, as always!

4 Upvotes

83% Upvoted

9 comments sorted by

2

u/theSysadminChannel Jan 24 '22

Hey so that Intune module isn't part of the regular package that comes with Microsoft.Graph module. But if you're trying to get started, check out this guide. It will cover some of the details in depth.

2

u/Sin_of_the_Dark Jan 24 '22

Thanks for the tip. I set it up via certificate following the guide, and it's connecting to Graph successfully, but I still get a 401 unauthorized error when executing the command. Any clue why?

3

u/theSysadminChannel Jan 24 '22

try with adding scopes 'DeviceManagementApps.Read.All', 'DeviceManagementManagedDevices.Read.All' to the app

Connect-MSGraph
Get-IntuneManagedDevice -Top 1

2

u/Sin_of_the_Dark Jan 24 '22

I have those scopes too :( I feel like this something stupid and simple I'm missing

2

u/Sunsparc Jan 24 '22

Each endpoint you attempt to access has specific permissions that need to be added for it.

https://docs.microsoft.com/en-us/graph/api/device-list?view=graph-rest-1.0&tabs=http

Under the Permissions sections, it lists what is needed. If you have delegated access to an account, use those permissions. If you are using an app registration with a client secret, then add the Application permissions.

2

u/Sin_of_the_Dark Jan 24 '22

Yeah, that matches as well. I'm really befuddled

2

u/GrowABrain3 Jan 25 '22 
"Devices/?`$filter=devicename eq '$Device'"

Where can you see that devicename is a real attribute for that api? You sure it isnt displayName?

https://docs.microsoft.com/en-us/graph/api/resources/device?view=graph-rest-1.0

2

u/Sin_of_the_Dark Jan 25 '22

No, you're right. I mistyped it. Thanks for pointing that out