Microsoft Security | Microsoft Defender | Microsoft Defender for Cloud
A cloud-native solution that protects workloads across hybrid and multi-cloud environments with threat detection and security recommendations
Windows defender advanced queries return 403
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(54.400000000000006, 48%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EQA%3C/text%3E%3C/svg%3E)
QA Account
10
Reputation points
I am getting the following error when trying to use "advancedqueries".
how can I trace the issue? how can I fix it? (I have followed the documentation and I have all the relevant permissions)
Unauthorized request - reason of failure: Account mode is inactive
com.microsoft.graph.http.GraphServiceException: Error code: Unauthorized
Error message: Unauthorized request - reason of failure: Account mode is inactive
POST https://api.securitycenter.windows.com/api/advancedqueries/run
SdkVersion : graph-java/v5.46.0
Content-Type : application/json
User-Agent : MdePartner-Illusive-ActiveDefenseSuit[...]
[...]
403 :
Microsoft Security | Microsoft Defender | Microsoft Defender for Cloud
Microsoft Security | Microsoft Entra | Microsoft Entra ID
Microsoft Security | Microsoft Entra | Microsoft Entra ID
A cloud-based identity and access management service for securing user authentication and resource access
{count} vote
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Anonymous2023-05-01T19:16:45.5533333+00:00 Hi @QA Account , can you perform these checks and let me know what you find?
Verify your account status: Ensure that the account you are using to access the API is active and has the necessary permissions.
Check API permissions: Make sure that your application has the required API permissions and that an administrator has granted the necessary consent for those permissions.
Review your authentication process: Double-check your authentication process to ensure you are using the correct credentials and tokens when making API requests.
It seems the root cause is "Account mode is inactive" so these checks are a good start.
Best,
James
-
CarlZhao-MSFT 46,426 Reputation points2023-05-02T02:04:20.2566667+00:00 Hi @QA Account
Use jwt.ms to decode your access token and share screenshots.
-
Anonymous
2023-05-03T19:10:54.0133333+00:00 Hi @QA Account , were you able to decode your access token?
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(6.4, 68%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESN%3C/text%3E%3C/svg%3E)
Shrikanth Nayak (c) 0 Reputation points2023-06-09T07:31:12.68+00:00 Hi Team,
When I tried to get Machines using the API - api.securitycenter.microsoft.com/api/machines, got following error ->
{ "error": { "code": "Unauthorized", "message": "Unauthorized request - reason of failure: Account mode is inactive", "target": "|20a7baad-4139f5203793be74." } } -
Shrikanth Nayak (c) 0 Reputation points
2023-06-09T07:31:44.2733333+00:00 Here is the decoded access token payload
{ "aud": "https://securitycenter.onmicrosoft.com/windowsatpservice", "iss": "https://sts.windows.net/6366b374-5e80-4cd2-a08a-af1df99b3330/", "iat": 1686293773, "nbf": 1686293773, "exp": 1686297673, "aio": "E2ZgYFjJztyWKJat+qfq6Cp5lYOFAA==", "app_displayname": "test", "appid": "353d0d94-d5d6-4b38-9301-e8235e12f328", "appidacr": "1", "idp": "https://sts.windows.net/6366b374-5e80-4cd2-a08a-af1df99b3330/", "oid": "bbb90c0e-df70-4576-be96-ad2035feee6b", "rh": "0.AUoAdLNmY4Be0kygiq8d-ZszMGUEePwXINRAoMUwcCJHG5KJAAA.", "roles": [ "Machine.Isolate", "Event.Write", "SecurityConfiguration.ReadWrite.All", "IntegrationConfiguration.ReadWrite", "Machine.Scan", "Url.Read.All", "Ip.Read.All", "Ti.ReadWrite", "Ti.Read.All", "User.Read.All", "Machine.ReadWrite.All", "Ti.ReadWrite.All", "Machine.LiveResponse", "SecurityRecommendation.Read.All", "Machine.RestrictExecution", "Machine.StopAndQuarantine", "Alert.Read.All", "Software.Read.All", "SecurityConfiguration.Read.All", "File.Read.All", "Machine.CollectForensics", "Machine.Offboard", "SecurityBaselinesAssessment.Read.All", "Vulnerability.Read.All", "Library.Manage", "Machine.Read.All", "Score.Read.All", "RemediationTasks.Read.All", "Alert.ReadWrite.All", "AdvancedQuery.Read.All" ], "sub": "bbb90c0e-df70-4576-be96-ad2035feee6b", "tenant_region_scope": "AS", "tid": "6366b374-5e80-4cd2-a08a-af1df99b3330", "uti": "_LZq8KQh7EGfIffYwN6EAA", "ver": "1.0" }
Sign in to comment
Sign in to answer