Get-AzureRmRoleAssignment: Access denied to the specified API version

[bvirkler]

I'm trying to run Get-AzureRmRoleAssignment in an Azure Automation script while authenticated using the built-in RunAs service principal.

This cmdlet makes three API calls, the last of which is to the AAD Graph API's getObjectsByObjectIds. This call is failing with a Forbidden response with the message "Access denied to the specified API version".

I first noticed this back in February, and just confirmed that the issue still exists with the latest AzureRM modules built into Azure Automation (version 1.0.3, last modified 6/6/2016).

Lots more details in my SO post: http://stackoverflow.com/questions/35592847

[markcowl]

@bvirkler Yes, unfortunately the api-version used for graph is whitelisted for only first party applications, which means it will work for user credentials, but not service credentials.

There is an issue tracking this here: #1896

Closing this one as a duplicate, since it has the same root cause.