Defender for Endpont - Device Isolation via API

Question

Hello All,

I am trying to craft an script to isolate device via powershell.

I have created Enterprise app, i have assigned to that app permission (as delegated - i do not want to use it as application) Machine.Isolate and granted consent.

Script currently looks like this:

function Isolate-Device ($device) {
    $tenantId = "xxx"
    $clientId = "xxx"
    
    $MsalParams = @{
        ClientId = $clientId
        TenantId = $tenantId
        Scopes   = 'https://userrequestsgraphapiep-prd.trafficmanager.net//Machine.Isolate'
    }

    $MsalResponse = Get-MsalToken @MsalParams
    $token = $MsalResponse.AccessToken
    #$token

    $headers = @{
        Authorization = "Bearer $token"
    }
   
    $body = @{
        "Comment" = "Isolated"
        "IsolationType" = "Full"
    }
   
    $response = Invoke-RestMethod -Uri "https://api.securitycenter.microsoft.com/api/machines/$device/isolate" -Method POST -Body ($body | ConvertTo-Json) -Headers $headers -Verbose
}

Token looks like is generated correctly:

"scp": "AdvancedQuery.Read Machine.Isolate"

But when I try to run function i get error below:

Any idea on where i am making mistake? Thanks in advance!

Answer 1

@kimak, Thanks for posting in Q&A. From your description, it seems the issue is with API of Defender for Endpoint which we are not familiar with. You can contact Defender for Endpoint support in the following link to see if you can get more help on this.

https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/contact-support?view=o365-worldwide

Thanks for your understanding.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Try using this URI for both the token request and for the rest method:

https://api-us.securitycenter.microsoft.com