How to request data from Graph API in PowerShell?

Question

Hi,

I am a beginner in this, sorry in advance.

I need to get information from this URI in PowerShell: https://graph.microsoft.com/v1.0/identityGovernance/accessReviews/definitions.

I have created an application EntraID with the following permissions:

• AccessReview.ReadWrite.All
• Groups.Read.All

I have granted admin consent to the two.

I have this script:

# GET TOKEN
$uri = "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token"
$body = @{
    client_id     = $AppId
    scope         = "https://graph.microsoft.com/.default"
    client_secret = $AppSecret
    grant_type    = "client_credentials"
}


$tokenRequest = Invoke-WebRequest -Method Post -Uri $uri -ContentType "application/x-www-form-urlencoded" -Body $body -UseBasicParsing
# Unpack Access Token
$token = ($tokenRequest.Content | ConvertFrom-Json).access_token
$Headers = @{
            'Content-Type'  = "application\json"
            'Authorization' = "Bearer $Token" 
            'ConsistencyLevel' = "eventual" }

# GET DATA
$URI= "https://graph.microsoft.com/v1.0/identityGovernance/accessReviews/definitions"

Invoke-RestMethod -Headers $Headers -Uri $Uri -UseBasicParsing -Method "GET" -ContentType "application/json"

I receive a token that I can parse in jwt.ms.

I can't see the scopes or roles in this token (or at least, I can't find it).

But, for the URI I need info from,

"https://graph.microsoft.com/v1.0/identityGovernance/accessReviews/definitions"

I only receive a 403 Forbidden error...

I don't know what's wrong. Could you please help me?

Answer 1

Hello Diana,

Thank you for reaching out to Microsoft Support!

If you get a token that is parsed in jwt.ms and does not have a "roles" attribute, your token does not have any privileges, so a 403 error is expected.

Next, check in Azure that the permissions granted to your application need to be application permissions, as shown below:

Reference document:

https://learn.microsoft.com/en-us/graph/auth-v2-service?tabs=http

Hope this helps.

If the answer is helpful, please click Accept Answer and kindly upvote it. If you have any further questions about this answer, please click Comment.

Answer 2

If the token you've received does not reflect said permissions, you need to double-check the configuration on your app registration. What kind of permissions did you add to your app registration, and did you ensure that admin consent has been granted for them?