[BUG] Unknown Permissions Issue Running Backup #120

Meddell · 2023-06-21T18:25:09Z

Describe the bug
I had originally configured IntuneCD back in March 2023, I had recently noticed the ADO pipeline was failing due to a permission I had not added (DeviceManagementManagedDevices.ReadWrite.All). I added the permission to the app registration but now I am coming up with a new error that seems to be a permission issue but not too sure.

Error:
File "/home/vsts/.local/bin/IntuneCD-startbackup", line 8, in
sys.exit(start())
File "/home/vsts/.local/lib/python3.10/site-packages/IntuneCD/run_backup.py", line 370, in start
run_backup(args.path, args.output, exclude, token)
File "/home/vsts/.local/lib/python3.10/site-packages/IntuneCD/run_backup.py", line 270, in run_backup
results.append(savebackup(path, output, token))
File "/home/vsts/.local/lib/python3.10/site-packages/IntuneCD/backup_remoteAssistancePartner.py", line 28, in savebackup
data = makeapirequest(ENDPOINT, token)
File "/home/vsts/.local/lib/python3.10/site-packages/IntuneCD/graph_request.py", line 84, in makeapirequest
raise Exception(
Exception: ('Request failed with ', 403, ' - ', '{"error":{"code":"Forbidden","message":"{\r\n \"_version\": 3,\r\n \"Message\": \"An error has occurred - Operation ID (for customer support): 00000000-0000-0000-0000-000000000000 - Activity ID: cd0c3d1d-00ca-4a00-abdc-e0cf2c43a00e - Url: https://fef.msua05.manage.microsoft.com/RemoteAssistService/StatelessRemoteAssistService/deviceManagement/remoteAssistancePartners?api-version=5022-08-15 - CustomApiErrorPhrase: Forbidden\",\r\n \"CustomApiErrorPhrase\": \"Forbidden\",\r\n \"RetryAfter\": null,\r\n \"ErrorSourceService\": \"\",\r\n \"HttpHeaders\": \"{}\"\r\n}","innerError":{"date":"2023-06-21T17:29:40","request-id":"cd0c3d1d-00ca-4a00-abdc-e0cf2c43a00e","client-request-id":"cd0c3d1d-00ca-4a00-abdc-e0cf2c43a00e"}}}')
##[error]Bash exited with code '1'.

Current App Registration Permissions:

DeviceManagementConfiguration.ReadWrite.All
DeviceManagementApps.ReadWrite.All
DeviceManagementManagedDevices.ReadWrite.All
DeviceManagementServiceConfig.ReadWrite.All
Groups.Read.All
Policy.Read.All
Policy.ReadWrite.ConditionalAccess

To Reproduce
Within the Pipeline:

script: IntuneCD-startbackup -m 1
env:
REPO_DIR: $(DEVREPO_DIR)
TENANT_NAME: $(DEVTENANT_NAME)
CLIENT_ID: $(DEVCLIENT_ID)
CLIENT_SECRET: $(DEV_SECRET)
displayName: Run IntuneCD backup Dev

Currently ran with a client secret and app registration

Current App Registration Permissions:

DeviceManagementConfiguration.ReadWrite.All
DeviceManagementApps.ReadWrite.All
DeviceManagementManagedDevices.ReadWrite.All
DeviceManagementServiceConfig.ReadWrite.All
Groups.Read.All
Policy.Read.All
Policy.ReadWrite.ConditionalAccess

Expected behavior
Backup works accordingly without issues/errors

Screenshots

Run type (please complete the following information):

Mode: 1
Client Pipeline using Ubuntu-Latest
Version 1.4.9

almenscorner · 2023-06-22T04:43:18Z

Hi,

Definitely looks like you have all the required permissions and RemoteAssistancePartner requires the service config permission. Does it fail with that exact error if you re-run the pipeline every time? Can you run from your own terminal locally using the same app reg and see if you get the same result?

Meddell · 2023-06-22T13:24:09Z

Yep I had tried running the backup locally with the app registration and got the same error:

almenscorner · 2023-06-22T19:24:27Z

Interesting, can you send a print screen of the api permissions granted on the app reg?

Meddell · 2023-06-23T12:26:30Z

Sure thing, here are is the screenshot of it:

almenscorner · 2023-06-26T18:43:14Z

I'm trying to replicate but haven't been able to so far

Meddell · 2023-06-27T12:45:06Z

I will see if it was something with the app registration, going to replace the app registration and create a new one.
Edit: I tried with a new app registration and still an error. I excluded RemoteAssistancePartner and it worked as normal. I ran the query in Graph Explorer and it worked fine as well.

almenscorner · 2023-07-02T08:19:29Z

Do you have any remote assistance partners connected in Intune?

Speed1 · 2023-07-03T07:04:23Z

Hi,
we encounter the exact same error. We have a remote assistance partner configured (Teamviewer).

almenscorner · 2023-07-03T07:50:35Z

So it seems like there is a different behaviour when there is a partner connected.. the same permissions should still apply though. Is the call working for you as well running it with your account instead of the app reg @Speed1?

Speed1 · 2023-07-05T07:35:12Z

Sorry for the late response. I tried to run the application with the -i parameter but I get the following error after web authentication:

IntuneCD-startbackup -m 1 -p intuneBackup -i
Traceback (most recent call last):
  File "/Users/username/src/intuneCD/venv_intuneCD/bin/IntuneCD-startbackup", line 8, in <module>
    sys.exit(start())
             ^^^^^^^
  File "/Users/username/src/intuneCD/venv_intuneCD/lib/python3.11/site-packages/IntuneCD/run_backup.py", line 370, in start
    run_backup(args.path, args.output, exclude, token)
  File "/Users/username/src/intuneCD/venv_intuneCD/lib/python3.11/site-packages/IntuneCD/run_backup.py", line 165, in run_backup
    results.append(savebackup(path, output, exclude, token))
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/username/src/intuneCD/venv_intuneCD/lib/python3.11/site-packages/IntuneCD/backup_appConfiguration.py", line 34, in savebackup
    data = makeapirequest(ENDPOINT, token)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/username/src/intuneCD/venv_intuneCD/lib/python3.11/site-packages/IntuneCD/graph_request.py", line 24, in makeapirequest
    "Authorization": "Bearer {0}".format(token["access_token"]),
                                         ~~~~~^^^^^^^^^^^^^^^^
KeyError: 'access_token'

Do you have a hint?

almenscorner · 2023-07-07T12:36:42Z

Sorry for the late response. I tried to run the application with the -i parameter but I get the following error after web authentication:


IntuneCD-startbackup -m 1 -p intuneBackup -i

Traceback (most recent call last):

  File "/Users/username/src/intuneCD/venv_intuneCD/bin/IntuneCD-startbackup", line 8, in <module>

    sys.exit(start())

             ^^^^^^^

  File "/Users/username/src/intuneCD/venv_intuneCD/lib/python3.11/site-packages/IntuneCD/run_backup.py", line 370, in start

    run_backup(args.path, args.output, exclude, token)

  File "/Users/username/src/intuneCD/venv_intuneCD/lib/python3.11/site-packages/IntuneCD/run_backup.py", line 165, in run_backup

    results.append(savebackup(path, output, exclude, token))

                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  File "/Users/username/src/intuneCD/venv_intuneCD/lib/python3.11/site-packages/IntuneCD/backup_appConfiguration.py", line 34, in savebackup

    data = makeapirequest(ENDPOINT, token)

           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  File "/Users/username/src/intuneCD/venv_intuneCD/lib/python3.11/site-packages/IntuneCD/graph_request.py", line 24, in makeapirequest

    "Authorization": "Bearer {0}".format(token["access_token"]),

                                         ~~~~~^^^^^^^^^^^^^^^^

KeyError: 'access_token'

Do you have a hint?

Have you configured the app registration per the requirements here? https://github.com/almenscorner/IntuneCD/wiki/Authentication#interactive

almenscorner · 2023-08-04T11:06:26Z

I struggling to replicate the remote assistance partner issue as I do not have an environment with TV available. Did you get interactive auth run to work @Speed1?

Speed1 · 2023-08-04T13:01:12Z

Hi @almenscorner,

sorry, I totally forgot about this (currently excluded RemoteAssistancePartner from backup).
I retried but I still get the same error. I have the URL "http://localhost" added to my Redirect URIs in the App registration.

I also set TENANT_NAME and CLIENT_ID as env variables but no luck...

If I run the command IntuneCD-startbackup -m 1 -p intuneBackup -a secret.json it runs until the RemoteAssistancePartner as the Pipeline

almenscorner · 2023-08-04T14:32:17Z

Hmm, and the redirect URI is set as a "Mobile and desktop applications" type for the platform?

Speed1 · 2023-08-07T07:50:00Z

If you mean this flag, yes I tried to enable it but the error was the same.

almenscorner · 2023-08-08T10:59:37Z

I mean like this,

Speed1 · 2023-08-11T09:28:26Z

Now it works, thanks. I was confused from the phrase If using interactive mode, a Web Redirect URI needs to be added to the app registration with the value http://localhost". Maybe it should be changed in If using interactive mode, a Mobile and desktop applications Redirect URI needs...?

Nevermind, in interactive mode everything works as expected. The RemoteAssistancePartner was backuped

almenscorner · 2023-08-11T09:30:47Z

I will make it clearer in the text :)

OK, so there is something wrong, maybe a bug where when application permissions are used to export Remote Assistance partner the permissions are not working. Sounds like something I need to bring to Microsoft..

almenscorner · 2023-08-18T22:44:27Z

Hi @Speed1, I have engaged Microsoft in the issue of backing up remote assistance partners. Would you be able to provide me with an ActivityId of one of the failed calls?

almenscorner · 2023-09-01T05:16:41Z

@Speed1, are you able to provide me an ActivityID so I can move the discussions forward? 😊

almenscorner · 2023-09-01T05:17:16Z

You could also do a new run and provide the ActivityID @Meddell ?

Speed1 · 2023-09-01T11:40:39Z

Hi @almenscorner
Sorry, I'm still on holidays. I will provide you on Monday with an activity ID.

Speed1 · 2023-09-04T09:15:24Z

Hi @almenscorner
here the activityID 97aa6610-5155-4e74-a784-bdc6f7def485
Sorry for the delay...

almenscorner · 2023-09-04T11:11:11Z

Hi @almenscorner here the activityID 97aa6610-5155-4e74-a784-bdc6f7def485 Sorry for the delay...

No worries, thank you very much! :)

AlphaSeb · 2023-11-20T15:06:17Z

Were also impacted by this. We have an active TeamViewer Integration, but as it's useless (for us) I simply disconnected it...

almenscorner · 2023-11-20T16:00:55Z

Yeah I'm hearing nothing from MS unfortunately

mrtzlbm · 2023-12-15T15:44:00Z

Were also impacted by this error. We have an active TeamViewer connector. Activity ID: 4d4d0345-789b-4544-bdf0-579364683170

almenscorner · 2024-02-05T10:03:07Z

I am getting no responses from MS... Can everyone create a ticket with MS on this so we get some push on it?

almenscorner · 2024-02-26T21:37:09Z

I have been able to backup a remote assistance partner with application permissions lately. Is this working for you as well now?

almenscorner · 2024-02-28T15:24:26Z

See above @mrtzlbm @AlphaSeb @Meddell

Meddell · 2024-03-07T16:49:57Z

Sorry for the late response as projects have shifted within our team for a long time but yes problem is resolved

Meddell added the bug Something isn't working label Jun 21, 2023

almenscorner mentioned this issue Jul 7, 2023

[BUG] Request failed with ', 401, #122

Closed

almenscorner added verified The bug has been verified external The bug is not within IntuneCD labels Aug 11, 2023

almenscorner pinned this issue Aug 20, 2023

almenscorner unpinned this issue Feb 5, 2024

almenscorner pinned this issue Feb 5, 2024

twigie4 mentioned this issue Feb 8, 2024

[FEATURE] Backup activation lock bypass code (iOS/iPadOS/macOS) #157

Closed

almenscorner closed this as completed Mar 7, 2024

almenscorner unpinned this issue Mar 26, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[BUG] Unknown Permissions Issue Running Backup #120

[BUG] Unknown Permissions Issue Running Backup #120

Meddell commented Jun 21, 2023

almenscorner commented Jun 22, 2023

Meddell commented Jun 22, 2023

almenscorner commented Jun 22, 2023

Meddell commented Jun 23, 2023

almenscorner commented Jun 26, 2023

Meddell commented Jun 27, 2023 •

edited

almenscorner commented Jul 2, 2023

Speed1 commented Jul 3, 2023

almenscorner commented Jul 3, 2023

Speed1 commented Jul 5, 2023

almenscorner commented Jul 7, 2023

almenscorner commented Aug 4, 2023

Speed1 commented Aug 4, 2023 •

edited

almenscorner commented Aug 4, 2023

Speed1 commented Aug 7, 2023

almenscorner commented Aug 8, 2023

Speed1 commented Aug 11, 2023 •

edited

almenscorner commented Aug 11, 2023

almenscorner commented Aug 18, 2023

almenscorner commented Sep 1, 2023

almenscorner commented Sep 1, 2023

Speed1 commented Sep 1, 2023

Speed1 commented Sep 4, 2023

almenscorner commented Sep 4, 2023

AlphaSeb commented Nov 20, 2023

almenscorner commented Nov 20, 2023

mrtzlbm commented Dec 15, 2023

almenscorner commented Feb 5, 2024

almenscorner commented Feb 26, 2024

almenscorner commented Feb 28, 2024

Meddell commented Mar 7, 2024 •

edited

[BUG] Unknown Permissions Issue Running Backup #120

[BUG] Unknown Permissions Issue Running Backup #120

Comments

Meddell commented Jun 21, 2023

almenscorner commented Jun 22, 2023

Meddell commented Jun 22, 2023

almenscorner commented Jun 22, 2023

Meddell commented Jun 23, 2023

almenscorner commented Jun 26, 2023

Meddell commented Jun 27, 2023 • edited

almenscorner commented Jul 2, 2023

Speed1 commented Jul 3, 2023

almenscorner commented Jul 3, 2023

Speed1 commented Jul 5, 2023

almenscorner commented Jul 7, 2023

almenscorner commented Aug 4, 2023

Speed1 commented Aug 4, 2023 • edited

almenscorner commented Aug 4, 2023

Speed1 commented Aug 7, 2023

almenscorner commented Aug 8, 2023

Speed1 commented Aug 11, 2023 • edited

almenscorner commented Aug 11, 2023

almenscorner commented Aug 18, 2023

almenscorner commented Sep 1, 2023

almenscorner commented Sep 1, 2023

Speed1 commented Sep 1, 2023

Speed1 commented Sep 4, 2023

almenscorner commented Sep 4, 2023

AlphaSeb commented Nov 20, 2023

almenscorner commented Nov 20, 2023

mrtzlbm commented Dec 15, 2023

almenscorner commented Feb 5, 2024

almenscorner commented Feb 26, 2024

almenscorner commented Feb 28, 2024

Meddell commented Mar 7, 2024 • edited

Meddell commented Jun 27, 2023 •

edited

Speed1 commented Aug 4, 2023 •

edited

Speed1 commented Aug 11, 2023 •

edited

Meddell commented Mar 7, 2024 •

edited