API results -- "Missing application roles. API required roles: Alert.Read.All,Alert.ReadWrite.All, application roles: Incident.Read.All,AdvancedHunting.Read.All."

Question

API results -- "Missing application roles. API required roles: Alert.Read.All,Alert.ReadWrite.All, application roles: Incident.Read.All,AdvancedHunting.Read.All."

Steven Francesco 0

I have reviewed just about every Microsoft document and tried to use Co-Pilot to resolve. I am able to get a token, using the scope=https://api.security.microsoft.com/.default. Just can't get passed this error ""Missing application roles. API required roles: Alert.Read.All,Alert.ReadWrite.All, application roles: Incident.Read.All,AdvancedHunting.Read.All."

I have set the permissions

DefenderAPIApp (1)
DefenderAPIApp (1)
Read.files	Delegated	Read user Files	Yes	Granted for Cyber Risks Services
Microsoft Graph (3)
Application.Read.All	Delegated	Read applications	Yes	Granted for Cyber Risks Services
Application.ReadUpdate.All	Delegated	Read and update all apps	Yes	Granted for Cyber Risks Services
Application.ReadWrite.All	Delegated	Read and write all applications	Yes	Granted for Cyber Risks Services
Microsoft Threat Protection (2)
AdvancedHunting.Read.All	Application	Run advanced hunting queries	Yes	Granted for Cyber Risks Services
Incident.Read.All	Application	Read all incidents	Yes	Granted for Cyber Risks Services

2 answers

Your answer

Answer 1

To resolve the "Missing application roles" error, ensure that your application has the required permissions correctly set in the Azure portal. Based on your description, it seems you need to verify that the following roles are assigned to your application:

Alert.Read.All - This permission allows the application to read all alerts.
Alert.ReadWrite.All - This permission allows the application to read and write alerts.
Incident.Read.All - This permission allows the application to read all incidents.
AdvancedHunting.Read.All - This permission allows the application to run advanced hunting queries.

Make sure that these permissions are granted at the application level and that you have consented to them. After setting the permissions, you may need to re-authenticate to obtain a new token that includes these permissions.

If you continue to face issues, double-check the scopes you are using when acquiring the token to ensure they match the required permissions for the API you are trying to access.

Answer 2

Vasil Michev 123.5K MVP Volunteer Moderator

Which endpoint/method are you querying, can you share a sample request? Sometimes the documentation can be incorrect, and not only with regards to permissions. For this specific scenario, you'd likely need to consent to the permissions returned in the error message. If you share the request/endpoint, we can confirm whether this is indeed needed/test on our end as well.

Also, can you clarify the context you are running with? The info above shows a mix of delegate and application permissions, so it's not clear which ones are relevant to the task at hand. Keep in mind that for delegate permissions you might need to also assign an admin role to the principal used.

Steven Francesco 0 Reputation points

2025-12-08T18:02:17.3466667+00:00

I appreciate your support -- as this has been driving me crazy.

https://us.api.security.microsoft.com/api/alerts?`$top=10

-H "Content-Type: application/json" \

-H "Accept: application/json" \

-H "Authorization: Bearer " & $AccessToken & "

I have admin and global rights -- but I also can remove the delegate roles, as I was just reaching.
Steven Francesco 0 Reputation points

2025-12-08T18:20:29.4266667+00:00

I also noticed in the Microsoft Defender portal that the device is be Managed by Intune and not MDE. Is this correct?
Vasil Michev 123.5K Reputation points MVP Volunteer Moderator

2025-12-08T20:13:17.6033333+00:00

Right, so for the endpoint in question you'd need either the Alert.ReadWrite.All application permission (if running without a signed in user) or the Alert.ReadWrite delegate one, if running in the context of a user. Those are permissions for the WindowsDefenderATP resource.

Neither permission seems to be granted to the app, according to what you've shared in the initial post. Make sure to add the appropriate role/scope, consent to it, request a new token and rerun the request. When adding the permission, go to APIs my organization uses > search for WindowsDefenderATP, then select the corresponding type and the permission itself.

To be clear, you don't need to add both the delegate and application permissions, just the one type corresponding to the context you are using.
Steven Francesco 0 Reputation points

2025-12-08T22:31:43.3166667+00:00

When assigning permission from WindowsDefenderATP, should I use the applications permissions or delegated?

Steven Francesco 0

DefenderAPIApp (1)
DefenderAPIApp (1)
Read.files	Delegated	Read user Files	Yes	Granted for Cyber Risks Services
Microsoft Graph (3)
Application.Read.All	Application	Read all applications	Yes	Granted for Cyber Risks Services
Application.ReadUpdate.All	Application	Read and update all apps	Yes	Granted for Cyber Risks Services
Application.ReadWrite.All	Application	Read and write all applications	Yes	Granted for Cyber Risks Services
Microsoft Threat Protection (2)
AdvancedHunting.Read.All	Application	Run advanced hunting queries	Yes	Granted for Cyber Risks Services
Incident.Read.All	Application	Read all incidents	Yes	Granted for Cyber Risks Services
WindowsDefenderATP (2)
Alert.Read	Delegated	Read alerts	Yes	Granted for Cyber Risks Services
Alert.ReadWrite	Delegated	Read and write alerts	Yes	Granted for Cyber Risks Services

Steven Francesco 0

still getting -- {

"error" : 

{

	"code" : "Forbidden",

	"message" : "Missing application roles. API required roles: Alert.Read.All,Alert.ReadWrite.All, application roles: Incident.Read.All,AdvancedHunting.Read.All.",

	"target" : "|edb5e38b-4275b0460c4a3280.1."

}

}

Vasil Michev 123.5K Reputation points MVP Volunteer Moderator

2025-12-09T08:47:28.5233333+00:00

Delegate and application permissions cannot be used interchangeably, you need to use the ones corresponding to the selected authentication flow. It looks like you are using the client credentials flow (authenticating via certificate or client secret), in which case you need to add (and consent to) application permissions, not delegate ones.
Steven Francesco 0 Reputation points

2025-12-09T15:08:49.1733333+00:00

I replaced them with application permissions. It did not change the outcome. Should app roles be defined with the api app --

Share via

API results -- "Missing application roles. API required roles: Alert.Read.All,Alert.ReadWrite.All, application roles: Incident.Read.All,AdvancedHunting.Read.All."

2 answers

Your answer