Graph authorization error

Reinout Dorreboom 96 Reputation points

I want to add a Trusted location in the Azure Conditional policies with MS Graph.

I have the next powerrshell script. The $body is converted to JSON, and the converted JSON works just fine in the MS Graph explorer, just as expected.

$body = @{
    "@odata.type"       = "#microsoft.graph.countryNamedLocation"
    countriesAndRegions = @(
    countryLookupMethod = "clientIpAddress"
    displayName         = $ExcludedCountryDisplayName   
}| ConvertTo-Json

$NamedLocationURI = ""
$NamedLocation = Invoke-RestMethod -Uri $NamedLocationURI -Headers $authToken -body $Body -Method POST -ContentType "application/json"
logwrite -logfile $Logfile -type Informational -logstring "De named location `"$ExcludedCountryDisplayName`" is aangemaakt!"

However when i run it in my script I get an error: The remote server returned an error: (403) Forbidden. Of course this probably has something to do with the bearer token, however if a run another JSON - one to create a new Azure AD group - that runs without any problems with the same token...

 $Body = @{
                description     = $Description
                displayName     = $DisplayName
                mailEnabled     = $false
                mailNickname    = ($DisplayName + "-" + (get-random -Minimum 100000 -Maximum 999999))
                securityEnabled = $true
            $Group = Invoke-RestMethod -Uri $BaseUrl -Headers $authToken -body $Body -Method POST -ContentType "application/json"
            logwrite -logfile $Logfile -type Informational -logstring "De security groep $DisplayName is aangemaakt..."

I use the same (global admin) account both scripts and also in the Graph explorer. It is strange, since i can use the authentication token for creating all policies we need, except the policies created under Conditional access: all of them gave me problems with authentication. (in the scripts, not in graph, not manual on the site with the same accounts).

I got my header via:

$AccessToken = Connect-MSGraph -ForceInteractive -PassThru

$AuthToken = @{
    Authorization = "Bearer $AccessToken"

I have no idea anymore... Does anyone have an idea?

Microsoft Graph
Microsoft Graph
A Microsoft programmability model that exposes REST APIs and client libraries to access data on Microsoft 365 services.
9,101 questions
Microsoft Intune
Microsoft Intune
A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.
3,679 questions
0 comments No comments
{count} votes

2 answers

Sort by: Most helpful
  1. Lu Dai-MSFT 28,191 Reputation points

    @Reinout Dorreboom Thanks for posting in our Q&A.

    For this error message, it seems that we don't have enough permissions. It is suggested to enter F12 to get the detailed token information and try to use it. For example:

    Then please make sure that we have the "Policy.Read.All" permission in Graph Explorer.

    If this issue still exists, please understand that conditional access works with Azure AD resources in Microsoft Graph, so it is suggested to contact Azure AD support to get more accurate help. Here is the support link:

    Hope it will help

    If the response is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

  2. Reinout Dorreboom 96 Reputation points

    Thank you for you answer Lu Dai!

    I will wait for an answer and in mean time i will try to get some info with the MS Graph Intune SDK team

    Thank you for your valuable time!