Windows defender advanced queries return 403

QA Account 5

I am getting the following error when trying to use "advancedqueries".

how can I trace the issue? how can I fix it? (I have followed the documentation and I have all the relevant permissions)

Unauthorized request - reason of failure: Account mode is inactive

com.microsoft.graph.http.GraphServiceException: Error code: Unauthorized

Error message: Unauthorized request - reason of failure: Account mode is inactive

POST https://api.securitycenter.windows.com/api/advancedqueries/run

SdkVersion : graph-java/v5.46.0

Content-Type : application/json

User-Agent : MdePartner-Illusive-ActiveDefenseSuit[...]

[...]

403 :

James Hamil 24,661 Reputation points Microsoft Employee

2023-05-01T19:16:45.5533333+00:00

Hi @QA Account , can you perform these checks and let me know what you find?

Verify your account status: Ensure that the account you are using to access the API is active and has the necessary permissions.

Check API permissions: Make sure that your application has the required API permissions and that an administrator has granted the necessary consent for those permissions.

Review your authentication process: Double-check your authentication process to ensure you are using the correct credentials and tokens when making API requests.

It seems the root cause is "Account mode is inactive" so these checks are a good start.

Best,

James
CarlZhao-MSFT 41,941 Reputation points

2023-05-02T02:04:20.2566667+00:00

Hi @QA Account

Use jwt.ms to decode your access token and share screenshots.
James Hamil 24,661 Reputation points Microsoft Employee

2023-05-03T19:10:54.0133333+00:00

Hi @QA Account , were you able to decode your access token?
Shrikanth Nayak (c) 0 Reputation points

2023-06-09T07:31:12.68+00:00
Hi Team,

When I tried to get Machines using the API - api.securitycenter.microsoft.com/api/machines, got following error ->

{ "error": { "code": "Unauthorized", "message": "Unauthorized request - reason of failure: Account mode is inactive", "target": "|20a7baad-4139f5203793be74." } }

Shrikanth Nayak (c) 0

Here is the decoded access token payload

{
  "aud": "https://securitycenter.onmicrosoft.com/windowsatpservice",
  "iss": "https://sts.windows.net/6366b374-5e80-4cd2-a08a-af1df99b3330/",
  "iat": 1686293773,
  "nbf": 1686293773,
  "exp": 1686297673,
  "aio": "E2ZgYFjJztyWKJat+qfq6Cp5lYOFAA==",
  "app_displayname": "test",
  "appid": "353d0d94-d5d6-4b38-9301-e8235e12f328",
  "appidacr": "1",
  "idp": "https://sts.windows.net/6366b374-5e80-4cd2-a08a-af1df99b3330/",
  "oid": "bbb90c0e-df70-4576-be96-ad2035feee6b",
  "rh": "0.AUoAdLNmY4Be0kygiq8d-ZszMGUEePwXINRAoMUwcCJHG5KJAAA.",
  "roles": [
    "Machine.Isolate",
    "Event.Write",
    "SecurityConfiguration.ReadWrite.All",
    "IntegrationConfiguration.ReadWrite",
    "Machine.Scan",
    "Url.Read.All",
    "Ip.Read.All",
    "Ti.ReadWrite",
    "Ti.Read.All",
    "User.Read.All",
    "Machine.ReadWrite.All",
    "Ti.ReadWrite.All",
    "Machine.LiveResponse",
    "SecurityRecommendation.Read.All",
    "Machine.RestrictExecution",
    "Machine.StopAndQuarantine",
    "Alert.Read.All",
    "Software.Read.All",
    "SecurityConfiguration.Read.All",
    "File.Read.All",
    "Machine.CollectForensics",
    "Machine.Offboard",
    "SecurityBaselinesAssessment.Read.All",
    "Vulnerability.Read.All",
    "Library.Manage",
    "Machine.Read.All",
    "Score.Read.All",
    "RemediationTasks.Read.All",
    "Alert.ReadWrite.All",
    "AdvancedQuery.Read.All"
  ],
  "sub": "bbb90c0e-df70-4576-be96-ad2035feee6b",
  "tenant_region_scope": "AS",
  "tid": "6366b374-5e80-4cd2-a08a-af1df99b3330",
  "uti": "_LZq8KQh7EGfIffYwN6EAA",
  "ver": "1.0"
}

Share via

Windows defender advanced queries return 403

Your answer