[QUESTION] STAT V2 AAD Risk Module 403 Forbidden

[KSJHASJBX]

Hi,

Hope you are doing well. I have deployed stat V2 according to the docs and ran the grantpermissions.ps1 script. It seems to work but I keep on receiving an 403 forbidden error in the AAD risk module. This is the output:

{
"statusCode": 400,
"headers": {
"Transfer-Encoding": "chunked",
"Date": "Fri, 29 Sep 2023 13:52:50 GMT",
"Content-Type": "application/json",
"Content-Length": "1258"
},
"body": {
"Error": "The API call to msgraph with path /v1.0/identityProtection/riskyUsers/21b3b6da-20e4-4751-ba82-7b268d028fb5 failed with status 403",
"InvocationId": "57658876-e69d-42c7-8bba-aea7185450bd",
"SourceError": {
"status_code": 403,
"reason": "Forbidden"
},
"Traceback": [
"Traceback (most recent call last):\n",
" File "/home/site/wwwroot/modules/init.py", line 19, in main\n return_data = coordinator.initiate_module(module_name=module_name, req_body=req_body)\n",
" File "/home/site/wwwroot/shared/coordinator.py", line 27, in initiate_module\n return_data = aadrisks.execute_aadrisks_module(req_body)\n",
" File "/home/site/wwwroot/modules/aadrisks.py", line 28, in execute_aadrisks_module\n user_risk_level = json.loads(rest.rest_call_get(base_object, api='msgraph', path=path).content)['riskLevel']\n",
" File "/home/site/wwwroot/shared/rest.py", line 109, in rest_call_get\n raise STATError(f'The API call to {api} with path {path} failed with status {response.status_code}', source_error={'status_code': int(response.status_code), 'reason': str(response.reason)})\n",
"classes.STATError: The API call to msgraph with path /v1.0/identityProtection/riskyUsers/21b3b6da-20e4-4751-ba82-7b268d028fb5 failed with status 403\n"
]
}
}

The tenant only has a Microsoft 365 Business Premium license. Does this hinder calling the Graph API for the AAD risks module?

[briandelmsft]

Hi @KSJHASJBX unfortunately it does appear to be a license issue.

According to the docs for the risky users API, you need an AAD P2 license to call it and from what I see M365 Business Premium comes with P1, not P2.

https://learn.microsoft.com/en-us/graph/api/resources/riskyuser?view=graph-rest-beta

[piaudonn]

@briandelmsft I will update the doc to make sure it reflects this, just to make sure.

The v-2 version should also make this a non-terminating error. Or at least mention overwrite the error message when status_code is 403 to include it might be a license thing.