Error when exporting device configuration objects with custom OMA-URI settings when using Read-Only servicePrincipal

[MarcoJanse]

I am experiencing some issues when exporting certain Device Configuration profiles while using a service principal with only read permissions.

The tool shows all components as orange and the GUI and I can browse trough all components.

However, when looking at the PowerShell console log, I see the following error messages for certain profiles:

Failed to invoke MS Graph with URL https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations//getOmaSettingPlainTextValue(secretReferenceValueId='') (Request ID: ). Status code: Forbidden. Response message: . Response message: Application is not authorized to perform this operation. Application must have one of the following scopes: DeviceManagementConfiguration.ReadWrite.All - Operation ID (for customer support): 00000000-0000-0000-0000-000000000000 - Activity ID: 143eb7cc-897a-419c-b46f-3e506acbc940 - Url: https://fef.msub02.manage.microsoft.com/DeviceConfiguration_2408/StatelessDeviceConfigurationFEService/deviceManagement/deviceConfigurations('')/microsoft.management.services.api.getOmaSettingPlainTextValue(secretReferenceValueId='')?api-version=5024-05-08 Exception: The remote server returned an error: (403) Forbidden.

The policies that fail are all configured with custom OMA-URI settings.

When I look at the results of the policies when I export them with readOnly permissions, the following values are different

    "omaSettings":  [
                        {
                            "secretReferenceValueId":  "<referenceID",
                            "isEncrypted":  true,
                            "value":  "****"
                        }

The service principal has been granted these permissions:

• 'Agreement.Read.All'
• 'Application.Read.All'
• 'CloudPC.Read.All'
• 'DeviceManagementApps.Read.All'
• 'DeviceManagementConfiguration.Read.All'
• 'DeviceManagementManagedDevices.Read.All'
• 'DeviceManagementRBAC.Read.All'
• 'DeviceManagementServiceConfig.Read.All'
• 'Group.Read.All'
• 'Organization.Read.All'
• 'Policy.Read.All'
• 'Policy.Read.ConditionalAccess'
• 'User.Read.All'

When connecting with my own admin user that also has write access on above scopes, I can export all settings.
Should I really need to configure DeviceManagementConfiguration.ReadWrite.All to properly read the OMA-URI settings?

[Micke-K]

Hello,

Yes, you will need ReadWrite permissions to get the Oma-Uri values. It's a requirement of the Graph API.

It's documented here:
getOmaSettingPlainTextValue

Cheers!

[MarcoJanse]

I see! Thanks for the quick response