Application is not authorized to perform this operation

[hotzenwalder]

When starting this tool as a Global Admin in our Tenant (and have all the rights in Intune/365/AAD) the toolbox says the application is not authorized to perform this operation, although we did authorize using a Global Admin account and Accepted all the required permissions for the app. Tried it with Visual Studio Code, Powershell ISE etc

The errors are

Get-MgUserPhotoContent : Accessing service failed. At C:\Tools\IntuneToolBox-main\modules\utility.psm1:232 char:7

• Get-MgUserPhotoContent -UserId $upn -OutFile $path

• 
  + CategoryInfo          : InvalidOperation: ({ UserId = ************* }:<>f__AnonymousType5`1) [Get-MgUserPhotoContent_Get], RestException`1
  + FullyQualifiedErrorId : ErrorWrongServer,Microsoft.Graph.PowerShell.Cmdlets.GetMgUserPhotoContent_Get
  get-content : Cannot find path 'C:\Tools\IntuneToolBox-main\.tmp\*************.png' because it does not exist.
  At C:\Tools\IntuneToolBox-main\modules\utility.psm1:234 char:49

• ... LogIn = [convert]::ToBase64String((get-content $path -encoding byte))

• 
  + CategoryInfo          : ObjectNotFound: (C:\Tools\Intune...dmin@***.png:String) [Get-Content], ItemNotFoundException
  + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.GetContentCommand

Exception calling "ToBase64String" with "1" argument(s): "Value cannot be null. Parameter name: inArray" At C:\Tools\IntuneToolBox-main\modules\utility.psm1:234 char:3

• $iconButtonLogIn = [convert]::ToBase64String((get-content $path -en ...

• 
  + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException  
  + FullyQualifiedErrorId : ArgumentNullException

Get-DecodeBase64Image : Cannot bind argument to parameter 'imageBase64' because it is an empty string. At C:\Tools\IntuneToolBox-main\modules\utility.psm1:235 char:66

• ... tonLogIn.source = Get-DecodeBase64Image -ImageBase64 $iconButtonLogIn

• 
  + CategoryInfo          : InvalidData: (:) [Get-DecodeBase64Image], ParameterBindingValidationException
  + FullyQualifiedErrorId : ParameterArgumentValidationErrorEmptyStringNotAllowed,Get-DecodeBase64Image

Get-MgDeviceManagementManagedDeviceOverview : { "_version": 3, "Message": "Application is not authorized to perform this operation. Application must have one of the following scopes: DeviceManagementManagedDevices.Read.All, DeviceManagementManagedDevices.ReadWrite.All - Operation ID ( for customer support): 00000000-0000-0000-0000-000000000000 - Activity ID: 2d354ac3-cffe-4ae6-b842-2e5695b1ff3d - Url: https://fef.amsub0102.manage.microsoft.com/DeviceFE/StatelessDeviceFEService/deviceManagement/managedDevi ceOverview?api-version=5022-05-24", "CustomApiErrorPhrase": "", "RetryAfter": null, "ErrorSourceService": "", "HttpHeaders": "{}" } At C:\Tools\IntuneToolBox-main\modules\pageMain.psm1:19 char:5

• $deviceManagementOverview = Get-MgDeviceManagementManagedDeviceOv ...

• 
  + CategoryInfo          : InvalidOperation: ({ Property = , ExpandProperty =  }:<>f__AnonymousType1`2) [Get-MgDeviceMan...iceOverview_Get], RestException`1
  + FullyQualifiedErrorId : Forbidden,Microsoft.Graph.PowerShell.Cmdlets.GetMgDeviceManagementManagedDeviceOverview_Get
  Get-MgDeviceManagementDeviceCompliancePolicyDeviceStateSummary : {
  "_version": 3,
  "Message": "Application is not authorized to perform this operation. Application must have one of the following scopes: DeviceManagementConfiguration.Read.All, DeviceManagementConfiguration.ReadWrite.All - Operation ID (fo 
  r customer support): 00000000-0000-0000-0000-000000000000 - Activity ID: 2979630c-11ee-4251-978d-9a785e2e83b4 - Url: https://fef.amsub0102.manage.microsoft.com/DeviceConfiguration_2206/StatelessDeviceConfigurationFEService/d 
  eviceManagement/deviceCompliancePolicyDeviceStateSummary?api-version=5022-04-13",
  "CustomApiErrorPhrase": "",
  "RetryAfter": null,
  "ErrorSourceService": "",
  "HttpHeaders": "{}"
  }
  At C:\Tools\IntuneToolBox-main\modules\pageMain.psm1:20 char:5

• $complianceOverview = Get-MgDeviceManagementDeviceCompliancePolic ...

• 
  + CategoryInfo          : InvalidOperation: ({ Property = , ExpandProperty =  }:<>f__AnonymousType1`2) [Get-MgDeviceMan...tateSummary_Get], RestException`1
  + FullyQualifiedErrorId : Forbidden,Microsoft.Graph.PowerShell.Cmdlets.GetMgDeviceManagementDeviceCompliancePolicyDeviceStateSummary_Get
  Get-MgDeviceManagementDeviceConfiguration : {
  "_version": 3,
  "Message": "Application is not authorized to perform this operation. Application must have one of the following scopes: DeviceManagementConfiguration.Read.All, DeviceManagementConfiguration.ReadWrite.All - Operation ID (fo
  r customer support): 00000000-0000-0000-0000-000000000000 - Activity ID: aa6d224d-f49e-451d-8b81-55fc2e7ad37e - Url: https://fef.amsub0102.manage.microsoft.com/DeviceConfiguration_2206/StatelessDeviceConfigurationFEService/d
  eviceManagement/deviceConfigurations?api-version=5022-04-13&$top=100",
  "CustomApiErrorPhrase": "",
  "RetryAfter": null,
  "ErrorSourceService": "",
  "HttpHeaders": "{}"
  }
  At C:\Tools\IntuneToolBox-main\modules\pageGroupMgmt.psm1:444 char:5

• Get-MgDeviceManagementDeviceConfiguration -All | ForEach-Object{

• 
  + CategoryInfo          : InvalidOperation: ({ Top = 100, Sk...ndProperty =  }:<>f__AnonymousType2`8) [Get-MgDeviceMan...figuration_List], RestException`1
  + FullyQualifiedErrorId : Forbidden,Microsoft.Graph.PowerShell.Cmdlets.GetMgDeviceManagementDeviceConfiguration_List
  Get-MgDeviceManagementDeviceCompliancePolicy : {
  "_version": 3,
  "Message": "Application is not authorized to perform this operation. Application must have one of the following scopes: DeviceManagementConfiguration.Read.All, DeviceManagementConfiguration.ReadWrite.All - Operation ID (fo
  r customer support): 00000000-0000-0000-0000-000000000000 - Activity ID: 2f1e6f32-8f7b-41f3-8bd3-055440cf172b - Url: https://fef.amsub0102.manage.microsoft.com/DeviceConfiguration_2206/StatelessDeviceConfigurationFEService/d
  eviceManagement/deviceCompliancePolicies?api-version=5022-04-13&$top=100",
  "CustomApiErrorPhrase": "",
  "RetryAfter": null,
  "ErrorSourceService": "",
  "HttpHeaders": "{}"
  }
  At C:\Tools\IntuneToolBox-main\modules\pageGroupMgmt.psm1:557 char:5

• Get-MgDeviceManagementDeviceCompliancePolicy -All | ForEach-Objec ...

• 
  + CategoryInfo          : InvalidOperation: ({ Top = 100, Sk...ndProperty =  }:<>f__AnonymousType2`8) [Get-MgDeviceMan...ancePolicy_List], RestException`1
  + FullyQualifiedErrorId : Forbidden,Microsoft.Graph.PowerShell.Cmdlets.GetMgDeviceManagementDeviceCompliancePolicy_List

[JayRHa]

I missed to add some permissions. Can you try if it works now?

[hotzenwalder]

Had two prompts for permissions this time, one where we could also give permission for the whole organization in our tenant. Seems to work now although we cannot click on anything on the Home screen

In the Group MGMT section we can do some more. The view area size however is too small so we have to scroll left and right or resize some columns since we cannot resize the whole Intune Tool Box screen.

Tiny other issue. When there is no profile picture associated with the account you use to manage the toolbox, you receive an error

Get-MgUserPhotoContent : Accessing service failed. At C:\Tools\IntuneToolBox-main\modules\utility.psm1:232 char:7

• Get-MgUserPhotoContent -UserId $upn -OutFile $path

• 
  + CategoryInfo          : InvalidOperation: ({ UserId = ******* }:<>f__AnonymousType5`1) [Get-MgUserPhotoContent_Get], RestException`1
  + FullyQualifiedErrorId : ErrorWrongServer,Microsoft.Graph.PowerShell.Cmdlets.GetMgUserPhotoContent_Get
  get-content : Cannot find path 'C:\Tools\IntuneToolBox-main\.tmp\*******.png' because it does not exist.
  At C:\Tools\IntuneToolBox-main\modules\utility.psm1:234 char:49

• ... LogIn = [convert]::ToBase64String((get-content $path -encoding byte))

• 
  + CategoryInfo          : ObjectNotFound: (C:\Tools\Intune...dmin*******.png:String) [Get-Content], ItemNotFoundException
  + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.GetContentCommand

Exception calling "ToBase64String" with "1" argument(s): "Value cannot be null. Parameter name: inArray" At C:\Tools\IntuneToolBox-main\modules\utility.psm1:234 char:3

• $iconButtonLogIn = [convert]::ToBase64String((get-content $path -en ...

• 
  + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
  + FullyQualifiedErrorId : ArgumentNullException

Get-DecodeBase64Image : Cannot bind argument to parameter 'imageBase64' because it is an empty string. At C:\Tools\IntuneToolBox-main\modules\utility.psm1:235 char:66

• ... tonLogIn.source = Get-DecodeBase64Image -ImageBase64 $iconButtonLogIn

• 
  + CategoryInfo          : InvalidData: (:) [Get-DecodeBase64Image], ParameterBindingValidationException
  + FullyQualifiedErrorId : ParameterArgumentValidationErrorEmptyStringNotAllowed,Get-DecodeBase64Image

Thanks for the quick response and all the efforts you make for the community.

[JayRHa]

Thank you for your feedback. I try to include this in the next version to give more possibilities to resize the screen. The bug with no profile picture I will fix until tomorrow.

[JayRHa]

Can you check the new version the bug is fixed an as already mention I will consider your feedback for the next version

[hotzenwalder]

Bug indeed fixed, can connect to our tenant, but the other issues remain (no resizing, cannot click on anything in home view)