Comments (11)
Could you please share a screenshot of the assigned API permissions for your application and the assigned roles? Thanks.
from microsoft365dsc.
Could you please share a screenshot of the assigned API permissions for your application and the assigned roles? Thanks.
The app registration only has the Global Reader role and is a Power Platform admin management application.
from microsoft365dsc.
Please check if you did assign:
OrganizationSettings.Read or if you need write access as well:
OrganizationSettings.ReadWrite
I did not see this API permission within the screenshot.
from microsoft365dsc.
I do not see that permission listed in my Azure portal. I also checked which permissions the application would need using Get-M365DSCCompiledPermissionList and that API permission doesn't appear.
Could this be a problem with how my app registration was created?
from microsoft365dsc.
Please check if you did assign:
OrganizationSettings.Read or if you need write access as well:
OrganizationSettings.ReadWrite
I did not see this API permission within the screenshot.
Is this a permission that I need to assign via PowerShell and not GUI?
from microsoft365dsc.
You could add the permission by using Graph PowerShell or the EntraId Admin Center.
Using Graph PowerShell you need to add the scope parameter to Connect-MGGraph with one of the scopes above.
Within EntraID you could update your app registration in the section api permissions.
from microsoft365dsc.
@andikrueger PP workload app doesn't require any API permissions, it just needs to be added to Power Apps as a mgmt app by an admin.
"Service principal applications are treated within Power Platform similar to how normal users are with the Power Platform Administrator role assigned. Granular roles and permissions can't be assigned to limit their capabilities. The application doesn't get any special role assigned in Microsoft Entra ID, as this is how platform services treat requests made by service principals."
from microsoft365dsc.
That is absolutely correct.
I was referring to the Exchange error message.
from microsoft365dsc.
Oh right, I didn't even see that resource there, O365 workload and specially O365OrgSettings is really a pain in the neck...
The log shows that it's failing on line 294 which corresponds for calling Get-DefaultTenantMyAnalyticsFeatureConfig
, this requires either Global admin, EXO admin or Insights admin Entra roles as per https://learn.microsoft.com/en-us/powershell/module/exchange/get-defaulttenantmyanalyticsfeatureconfig?view=exchange-ps
In my case I've assigned Insights administrator since it's the most restrictive, please bear in mind that assigning any one of these Entra roles is required even if only reading is required.
from microsoft365dsc.
Related Issues (20)
- Can event log be disabled when use DSC? HOT 1
- BUG?: [SPOSharingSettings] Settings appear to apply, except for RequireAcceptingAccountMatchInvitedAccount = $True HOT 7
- SPOSite: Unable to export the SharingDomainRestrictionMode & SharingAllowedDomainList settings
- AADConditionalAccessPolicy with TermsOfUse failed to create
- AADGroupOwnerConsentSettings is still a valid resource according to the website HOT 1
- Export: Unable to create reports from configuration exports HOT 2
- Your app has been throttled by AAD due to too many requests. HOT 10
- IntuneDeviceConfigurationDefenderForEndpointOnboardingPolicyWindows10: Error in catch block overwrites/hides original error?
- AADGroup: New group creation failing due to AssignedToRole parameter not found in the first run
- BUG? [SPOSharingSettings] throws error: "the member BccExternalSharingInvitations is not valid" HOT 9
- Unable to Export-M365DSCConfiguration using the -AccessTokens parameter. HOT 5
- Export-M365DSCConfiguration: Getting `You cannot call a method on a numm-valued expression` and empty report with PowerShell 7.
- Export-M365DSCConfiguration doesn't support combination of Credential and ApplicationId
- Export-M365DSCConfiguration directly to the Azure blob container HOT 1
- New resource for Entra ID password protection settings
- Follow-Up: New-M365DSCDeltaReport: "No discrepancies have been found!" when adding an exclusion to Conditional Access Policies
- [MSCloudLoginConnectionProfile] : Not found HOT 1
- O365SearchAndIntelligenceConfigurations : Unable to export
- EXOGroupSettings: Only exports 1000 objects HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from microsoft365dsc.