Azure AD - Adding Mobility (MDM + MAM)

Question

Azure AD - Adding Mobility (MDM + MAM)

Travis 1

I'm attempting to add Airwatch MDM from the Mobility (MDM+MAM) page of Azure AD. Each time I try to add this, I get an error, which states

"Failed to add application AirWatch by VMware"

When I click on the error, it seemingly provides no details of significance...the full error code is as such:

{"errorCode":"Unknown","localizedErrorDetails":{"errorDetail":null},"operationResults":null,"timeStampUtc":"2022-04-26T20:16:38.594764Z","clientRequestId":"7ff3cd08-08c1-4ad8-8ca6-35e1b9050059","internalTransactionId":"36d535be-6948-44e7-8369-9d50afe64e23","tenantId":null,"userObjectId":"6d39d1ab-6e2e-4237-bbf3-694a04fe7526","exceptionType":"AADGraphException"}

I've tried adding Airwatch MDM from a private browser tab as well with no luck.

I should also note - I can add other MDM applications, such as Scalefusion, without issue. The problem seems to be isolated to Airwatch.

Answer 1

Givary-MSFT 14,796 Microsoft Employee

@Travis

Thank you for reaching out to us. As I understand you are adding Airwatch by VMware from Mobility (MDM and MAM) blade.

From the details provided in the question, i see it is failing at AADGraphException, did a quick repro in my lab and i tried to add the same application, was able to add it successfully, during this process noticed following permissions are needed on Microsoft Graph

I wanted to check account you are using to perform this activity, what kind of permissions does it have for Microsoft Graph ?

Is it possible for you to perform the same operation with different Global admin account ? Also you can login to graph explorer, enter the credentials and verify the permissions ( under Modify permissions tab ).

If the issue still persists, let me know.

Reference: https://kb.vmware.com/s/article/86061

Travis 1 Reputation point

2022-04-27T14:41:06.17+00:00

@GirishVaryani ,

I tested with a different AAD account, using the Global Admin role - and unfortunately I got the same result/error as last time.

I did log into Graph Explorer with my user profile, and verified I had the appropriate permissions as well.
Givary-MSFT 14,796 Reputation points Microsoft Employee

2022-04-27T15:55:47.677+00:00

@Travis

Capture browser trace while reproducing the issue ( refer link for steps https://learn.microsoft.com/en-us/azure/azure-portal/capture-browser-trace ). Also help me with the audit logs at the time of issue to correlate.
Givary-MSFT 14,796 Reputation points Microsoft Employee

2022-04-29T05:46:59.213+00:00

@Travis

Offline troubleshooting performed on this issue, below are the steps:

Reviewed the browser trace & auditing logs, from the backend logs, noticed one of the Service Principal associated with this airwatch app is registered on a different application,

Ran the below command to check the same.
Get-AzureADServicePrincipal -All $true | where {$_.ServicePrincipalNames -like "https://ds1380.awmdm.com"} and confirmed different app using the same serviceprincipalname. As the different application which has this serviceprincipalname which is not in use, deleted the application.

Tried to add the Airwatch by VMware from Mobility (MDM and MAM) blade. we were able to add it successfully.

Let me know if you have any question.

Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.

Azure AD - Adding Mobility (MDM + MAM)

1 answer

Activity