Rest API: Get bitlockerRecoveryKey

DGONZA 1 Microsoft Employee

My customer is trying to extract data using this API from Azure Data Factory using the following URL "/informationProtection/bitlocker/recoveryKeys". However, they are getting the following error: {"code":"authorization_error","message":"Failed to authorize, token doesn't have the required permissions." We have made sure they have the permissions outlined in this doc (https://learn.microsoft.com/en-us/graph/api/bitlockerrecoverykey-get?view=graph-rest-1.0). Could you tell me if this is supported in ADF and if so what other permissions are needed? Thank you!

Zehui Yao_MSFT 5,831 Reputation points

2022-11-11T07:45:07.813+00:00

Hi @DGONZA , welcome to the forum!

Since I tested locally and the request was successful, so I would like to give some suggestions on this issue, which I hope will help you. If the following suggestions do not effectively solve the problem, you can continue to leave a message below and we can continue to investigate the problem.

First of all, you can parse the token you obtained in the jwt.ms to ensure that there are response permissions in the token.

Then note that BitLockerKey.ReadBasic.All, BitLockerKey.Read.All permission requires administrator consent so don't forget to click grant in AD.portal.

Finally, please note that the API only supports delegated permission (work or school account) and the calling user is required to have a special identity.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
DGONZA 1 Reputation point Microsoft Employee

2022-11-11T19:17:32.197+00:00

Thank you for your feedback, we did confirm they have the necessary permissions but still are not able to get passed through this error.
Zehui Yao_MSFT 5,831 Reputation points

2022-11-14T10:10:20.83+00:00

Hi @DGONZA , would you mind sharing the decoding result of the token?
DGONZA 1 Reputation point Microsoft Employee

2022-11-14T17:18:57.377+00:00

Not sure how to obtain that in azure data factory? Currently I have created a copy activity pipeline using a Rest Linked service that is authenticating using a service principal using azure key vault. The rest link service test connection works fine, and we are able to extract from the Graph Users folder however when using the link discussed "URL "/informationProtection/bitlocker/recoveryKeys" it gives us the error above.
KranthiPakala-MSFT 46,422 Reputation points Microsoft Employee

2022-11-23T02:49:41.783+00:00

Hello @DGONZA ,

Thanks for the question and using MS Q&A platform.

You can use https://jwt.io/ to decode your bearer token and validate if the required permissions are granted to the respective service principal.

Also please make sure:
In REST connector for Base URL you will have to just pass the actual base URL as https://graph.microsoft.com/

And in the Dataset configuration pass the relative URL as v1.0/informationProtection/bitlocker/recoveryKeys/b465e4e8-e4e8-b465-e8e4-65b4e8e465b4

Let us know how it goes.

Thanks
KranthiPakala-MSFT 46,422 Reputation points Microsoft Employee

2022-11-24T03:29:45.837+00:00

Hello @DGONZA ,

Checking to see if you have got a chance to validate your permission using the above link provided in my previous response.

Do let us know how it goes.

Thank you