Error occurred while executing RemoveDevice, Code: Authorization_RequestDenied

Question

Hi Techies,

I am facing issue with Remove-AzureADDevice -ObjectId $_.ObjectId. I am using my registered APP with Certificate Thumprint.

I have given enough permission to my app in delegate as well application for Graph API. but still when I am using powershell script to remove device is not working.

Below is the function, I am able to get devices using Get-AzureADUserRegisteredDevice -ObjectId $ObjectID. But while deleting the device only I am getting error message.

Error occurred while executing RemoveDevice
Code: Authorization_RequestDenied
Message: Insufficient privileges to complete the operation.
RequestId: 67a70f22-XXXXXXXXXXXXXXXXXXX
DateTimeStamp: Wed, 28 Feb 2024 08:30:23 GMT
HttpStatusCode: Forbidden
HttpStatusDescription: Forbidden
HttpResponseStatus: Completed

Function that I am using

Function Initiate-AAD-DeviceRetire
{
param(
[String]$Email,
[String]$ObjectID,
[String]$ID
)

$error.Clear()
$AADRegisteredDevices = Get-AzureADUserRegisteredDevice -ObjectId $ObjectID

$TotalAADDeviceCount = (Get-AzureADUserRegisteredDevice -ObjectId $ObjectID).count $AADRegisteredDevices | ForEach-Object { $DeviceObjectIDs += $.ObjectId + "," } $DeviceObjectIDsString = $DeviceObjectIDs.trim(',') $AADRegisteredDevices | ForEach-Object {Remove-AzureADDevice -ObjectId $.ObjectId} } Anyone faced similar issue, please help me :)

Answer 1

@Saravanan Periyasamy

Thank you for your detailed post!

Error occurred while executing 
RemoveDeviceCode: Authorization_RequestDenied
Message: Insufficient privileges to complete the operation.
HttpStatusCode: Forbidden

Based off your error details and reviewing the Remove-AzureADDevice documentation, it does look like you granted your application the correct permissions .

However, since the Directory.AccessAsUser.All delegated permission, allows your application to have the same access to information in the directory as the signed-in user. Please also make sure that the user you're signed in with has one of the following roles assigned.

• Microsoft Entra roles: Global Administrator, Intune Administrator, Windows 365 Administrator, or Cloud Device Administrator.

I hope this helps!

If you have any other questions or are still having issues, please let me know. Thank you for your time and patience throughout this issue.

---

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.