Microsoft Graph api for alertRules and alertRecords not working with CloudPC.ReadAll permissions.

Question

Microsoft Graph api for alertRules and alertRecords not working with CloudPC.ReadAll permissions.

Venkata Praveen Tellajeera 20

Hi Team,

We are trying to alert rules and records using Microsoft Graph apis (beta). Please find below the details:

APIs:
https://graph.microsoft.com/beta/deviceManagement/monitoring/alertRules

https://graph.microsoft.com/beta/deviceManagement/monitoring/alertRecords

Permissions: CloudPC.Read.All

Alerts status is ON in portal. But we are getting 403 forbidden error while accessing these apis. Please let me know if any more permissions or settings to be done.

Thanks in advance.

Yakun Huang 85 Reputation points

2024-03-29T03:04:52.8533333+00:00

hi @Venkata Praveen Tellajeera ,

Since we can't pinpoint the problem with this information alone, please use the https://jwt.ms/ link to parse the token you have obtained and share it with us so that we can better help you solve the problem.
Carolyne-3676 1,136 Reputation points

2024-04-09T08:41:45.3933333+00:00

@Venkata Praveen Tellajeera Hello! Did you manage to parse the token as advised above? That is the only way to verify the permissions that you have. Based on the documentation, CloudPC.Read.All is the least priviledge required and CloudPC.ReadWrite.All is a higher privilege. Also note that this is supported for delegated(work/school) and app permissions.
Venkata Praveen Tellajeera 20 Reputation points

2024-04-10T06:43:16.1333333+00:00

Hi Carolyne, we didn't get approval from our client to parse tokens.

We have already provided CloudPC.Read.All permissions (delegated and application) to the service principal used, to access these apis. Please let us know if any other permissions required to access this data.

Thanks in advance.
jhauan 1 Reputation point

2024-08-08T08:42:55.8033333+00:00

Can confirm the same issue using managed identity. Get 403 forbidden although the managed identity have the required permissions. (CloudPC.Read.All). Permission type is "Application" as well.