Multi Admin Approval and Enterprise App Invalid header

[ChrisJay77]

Hi, We are looking at using MAA and i've created an enterprise app with the permissions required but there is no way of adding a request header and get the following error when doing any actions: Failed to invoke MS Graph with URL https://graph.microsoft.com/beta/deviceManagement/deviceCompliancePolicies/203eb223-b8be-42ec-b424-2f0642f50110 (Request ID: 72a82304-a229-4c08-9066-1153286bff9a). Status code: BadRequest. Response message: . Response message: Header 'x-msft-approval-justification' is required to request approval - Operation ID (for customer support): 00000000-0000-0000-0000-000000000000 - Activity ID: 823bede1-15d1-44ce-9359-1d063d7c7b19 - Url: https://proxy.msub06.manage.microsoft.com/DeviceConfiguration_2606/StatelessDeviceConfigurationFEService/deviceManagement/deviceCompliancePolicies('203eb223-b8be-42ec-b424-2f0642f50110')?api-version=5026-05-10 Exception: The remote server returned an error: (400) Bad Request.
Is there a workaround for this or maybe in an upcoming version you could add a pop up box that asks for justification before selecting an action if using an app login? Thanks

[Micke-K]

Hello,

Did you use the tool to add permissions? Or did you try to add permissions in Entra?

If you added permissions manually in the portal, did you do admin approval on the delegated permissions?

It sounds like the scope permission is there but there is no admin consent to it.

Cheers

[ChrisJay77]

Hi, Appreciate the quick response, I added the permissions in entra,

I've changed to enterprise app as per the following blog: https://patchmypc.com/blog/intune-multi-admin-approval-the-x-msft-approval-justification-error/

[ChrisJay77]

Got it working, you need to add the enterprise app to each individual access policy such as compliance to allow it to work. Hope it helps others.