Codename MDASH private preview: 403 'Feature not enabled'

Question

What we are trying to do

Onboard our tenant to Codename MDASH — agentic code security (private preview) following the official doc: https://learn.microsoft.com/en-us/security-exposure-management/ai-code-security-onboarding

We want to complete Step 3 (Defender portal onboarding: enter Foundry project endpoint + API key → Validate → Save) and then run AI scans on a GitHub repo / custom source code.

(Tenant id and resource names are masked for privacy — full details are available in our support ticket, or I can share them privately with Microsoft staff.)

Access and setup we HAVE (all verified)

Item	Status
Tenant	Single-tenant org — tenant id e73e95e4-****-****-****-************ (India geo)
Tenant	Single-tenant org — tenant id e73e95e4-****-****-****-************ (India geo)
Preview approval	Applied and approved via [Mod Removed: Private preview link ] (first thing we did)
Entra role	Signed-in user is Global Administrator (verified via Graph /me/memberOf)
Licenses on tenant	Defender Vulnerability Management Premium Standalone (Enabled), Defender for Cloud Apps standalone, Office 365 Business Essentials
Microsoft Foundry	Dedicated resource (name masked) with project endpoint + API key; gpt-5.4, gpt-5.3-codex, gpt-5.4-mini deployed
Defender CLI	3.0.0-rc.34 on WSL Ubuntu 24.04, installed from cli.dfd.security.azure.com
Azure CLI	2.88.0, signed in with device-code flow
CLI authentication	az login --tenant <tenant-id> --scope <FPA>/Defender.InteractiveLogin --allow-no-subscriptions — token valid
Microsoft Defender Code app	No E5, so provisioned manually per the admin-consent doc: service principal created + tenant-wide admin consent for Defender.InteractiveLogin
App roles	AiScan.Enabled.Role, AiScan.Upload.Role, AiScan.View.Role assigned to our admin user — fresh token verified to contain all three roles

Symptom 1 — Defender portal: Exposure Management pages (Overview / Initiatives) start loading, then redirect to Home. Network trace: GET https://security.microsoft.com/apiproxy/mtp/posture/oversight/tenants?warmCache=true → HTTP 404. So the onboarding flow (Steps 1–3) can never be opened.

Symptom 2 — Defender CLI: defender scan ai-scan profile list fails with: caller not authorized (token valid, allowed-callers list)

CLI trace (--log-level trace) shows the underlying service response. First call returns {"error":"geo_mismatch","gatewayGeo":"US","tenantGeo":"IN"}; after the CLI re-pins geo (sends header Geo: in), the service answers:

{"title":"Feature not enabled","status":403,"detail":"This feature is not enabled for the requesting tenant."}

So: token is valid and carries the AiScan roles, but the MDASH/ASPM backend says the feature is not enabled for our tenant.

What we have already ruled out

• Not a permissions problem — user is Global Administrator; token contains all three AiScan app roles.
• Not missing admin consent — Microsoft Defender Code enterprise app + tenant-wide consent completed (docs' non-E5 path).
• Not CLI/version/auth setup — followed the Defender CLI setup + install docs exactly; authentication succeeds.
• Not a licensing gap for Exposure Management, as far as we can tell — tenant has Defender Vulnerability Management Premium Standalone, which the XSEM prerequisites list as qualifying.

Questions for the community / Microsoft team

1. For the private preview, is the feature flag enabled per tenant id? How can we confirm which tenant id our approval was recorded under?
2. Is the 403 "Feature not enabled" + portal 404 a sign that preview enablement hasn't propagated yet, or that approval is tied to a different tenant?
3. Does Exposure Management require any separate provisioning step for a tenant that only has MDVM Standalone (no E5 / no Defender for Endpoint P2)?
4. Is there anything else missing from our setup (see table above) that would block Step 3? Thank You

Sachin

Answer 1

Hey there, 3rag

Applied and approved via [Mod Removed: Private preview link ] (first thing we did)

When you were approved, did you get an email inviting you to the Microsoft tenant?

If so, did you join as this is the best place to ask this question because this is a private preview.

For the private preview, is the feature flag enabled per tenant id?

Yes.

When the product manager/program manager enrols you onto the private preview, then they will send an email to you informing you that you have been enrolled and provides information on where you can get more information about the private preview.

How can we confirm which tenant id our approval was recorded under?

The tenant ID will be the tenant ID you provided in the application form to sign-up for the private preview. So this would be the tenant ID you have provided.

If you can't remember, and have multiple tenant ID's, please change directory using the "Change Directory" option when you click onto your avatar on the admin portal. Alternatively, you can reply directly to the email address and ask them to check which directory they have applied it to. I do believe they can check on this for you.

Is the 403 "Feature not enabled" + portal 404 a sign that preview enablement hasn't propagated yet, or that approval is tied to a different tenant?

I would read this as though the feature hasn't been enabled for the tenant you are currently in, although I could be mistaken.

Really, if you are in the private preview, these questions should be asked within the internal team channel. Please can you tell me if you have had an email inviting you to the Microsoft tenant for the program?

Thanks,
Nathan