Bad Request When Accessing Conditional Access Settings

[iperry-indigex]

On running Get-MgDeviceManagementConditionalAccessSetting, the following error is produced: in v1.0:

Get-MgDeviceManagementConditionalAccessSetting_Get1: {
  "_version": 3,
  "Message": "An error has occurred - Operation ID (for customer support): 00000000-0000-0000-0000-000000000000 - Activity ID: 68fb7bd7-57d8-4f9e-9f55-83c2ac2889c3 - Url: https://fef.amsua0102.manage.microsoft.com/StatelessOnboardingService/deviceManagement/conditionalAccessSettings?api-version=2020-05-08",
  "CustomApiErrorPhrase": "",
  "RetryAfter": null,
  "ErrorSourceService": "",
  "HttpHeaders": "{}"
}

in beta:

Get-MgDeviceManagementConditionalAccessSetting_Get: {
  "_version": 3,
  "Message": "An error has occurred - Operation ID (for customer support): 00000000-0000-0000-0000-000000000000 - Activity ID: 02c29b58-ee71-43fc-a665-9327fd2beb4d - Url: https://fef.amsua0102.manage.microsoft.com/StatelessOnboardingService/deviceManagement/conditionalAccessSettings?api-version=5020-10-15",
  "CustomApiErrorPhrase": "",
  "RetryAfter": null,
  "ErrorSourceService": "",
  "HttpHeaders": "{}"
}

Upon further looking, it appears to receive a bad request error from the server.

Exception             :
    Type            : Microsoft.Graph.PowerShell.Runtime.RestException`1[[Microsoft.Graph.PowerShell.Models.IOdataError, Microsoft.Graph.DeviceManagement.Enrolment.private, Version=1.4.2.0,
Culture=neutral, PublicKeyToken=[redacted]]]
    Error           : Microsoft.Graph.PowerShell.Models.OdataError
    StatusCode      : BadRequest
    Code            : BadRequest
    RequestMessage  : Method: GET, RequestUri: 'https://graph.microsoft.com/v1.0/deviceManagement/conditionalAccessSettings', Version: 1.1, Content: <null>, Headers:
                      {
                      SdkVersion: Graph-powershell-Microsoft.Graph.Authentication-1.4.2
                      SdkVersion: Graph-dotnet-1.20.1
                      FeatureFlag: 00000047
                      Cache-Control: no-store, no-cache
                      Authorization: Bearer [redacted]
                      Accept-Encoding: gzip
                      }
    ResponseHeaders :
        Key   : Date
        Value :
            Length : 29

        Key   : Transfer-Encoding
        Value :
            Length : 7

        Key   : Vary
        Value :
            Length : 15

        Key   : Strict-Transport-Security
        Value :
            Length : 16

        Key   : request-id
        Value :
            Length : 36

        Key   : client-request-id
        Value :
            Length : 36

        Key   : x-ms-ags-diagnostic
        Value :
            Length : 122
    ResponseBody    : {
                      "error": {
                      "code": "BadRequest",
                      "message": "{\r\n  \"_version\": 3,\r\n  \"Message\": \"An error has occurred - Operation ID (for customer support): 00000000-0000-0000-0000-000000000000 - Activity ID:
68fb7bd7-57d8-4f9e-9f55-83c2ac2889c3 - Url: https://fef.amsua0102.manage.microsoft.com/StatelessOnboardingService/deviceManagement/conditionalAccessSettings?api-version=2020-05-08\",\r\n
\"CustomApiErrorPhrase\": \"\",\r\n  \"RetryAfter\": null,\r\n  \"ErrorSourceService\": \"\",\r\n  \"HttpHeaders\": \"{}\"\r\n}",
                      "innerError": {
                      "date": "2021-04-21T16:04:20",
                      "request-id": "68fb7bd7-57d8-4f9e-9f55-83c2ac2889c3",
                      "client-request-id": "68fb7bd7-57d8-4f9e-9f55-83c2ac2889c3"
                      }
                      }
                      }
    Message         : {
                      "_version": 3,
                      "Message": "An error has occurred - Operation ID (for customer support): 00000000-0000-0000-0000-000000000000 - Activity ID: 68fb7bd7-57d8-4f9e-9f55-83c2ac2889c3 - Url:
https://fef.amsua0102.manage.microsoft.com/StatelessOnboardingService/deviceManagement/conditionalAccessSettings?api-version=2020-05-08",
                      "CustomApiErrorPhrase": "",
                      "RetryAfter": null,
                      "ErrorSourceService": "",
                      "HttpHeaders": "{}"
                      }
    HResult         : -2146233088
TargetObject          : { Property = , ExpandProperty =  }
CategoryInfo          : InvalidOperation: ({ Property = , ExpandProperty =  }:<>f__AnonymousType1`2) [Get-MgDeviceManagem…lAccessSetting_Get1], RestException`1
FullyQualifiedErrorId : BadRequest,Microsoft.Graph.PowerShell.Cmdlets.GetMgDeviceManagementConditionalAccessSetting_Get1
ErrorDetails          : {
                        "_version": 3,
                        "Message": "An error has occurred - Operation ID (for customer support): 00000000-0000-0000-0000-000000000000 - Activity ID: 68fb7bd7-57d8-4f9e-9f55-83c2ac2889c3 - Url:
https://fef.amsua0102.manage.microsoft.com/StatelessOnboardingService/deviceManagement/conditionalAccessSettings?api-version=2020-05-08",
                        "CustomApiErrorPhrase": "",
                        "RetryAfter": null,
                        "ErrorSourceService": "",
                        "HttpHeaders": "{}"
                        }
InvocationInfo        :
    MyCommand        : Get-MgDeviceManagementConditionalAccessSetting_Get1
    ScriptLineNumber : 1
    OffsetInLine     : 1
    HistoryId        : 28
    Line             : $Test = Get-MgDeviceManagementConditionalAccessSetting
    PositionMessage  : At line:1 char:1
                       + $Test = Get-MgDeviceManagementConditionalAccessSetting
                       + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    InvocationName   : Get-MgDeviceManagementConditionalAccessSetting
    CommandOrigin    : Internal
ScriptStackTrace      : at Get-MgDeviceManagementConditionalAccessSetting<Process>,
/home/iperry/.local/share/powershell/Modules/Microsoft.Graph.DeviceManagement.Enrolment/1.4.2/exports/v1.0/ProxyCmdletDefinitions.ps1: line 115
                        at <ScriptBlock>, <No file>: line 1
PipelineIterationInfo :

I'm connecting to graph in powershell core 7.1.3, using an application that includes the Policy.Read.All permission. Authenticating via AppId/TenantId/Certificate combination. AB#9106

[peombwa]

Thank you for your question. Could you verify that:

• You have a valid Intune license.
• The signed is user has the relevant permissions.
• You have gone through the prerequisites.
• You are authenticated in delegated mode i.e. Connect-MgGraph -Scopes "DeviceManagementServiceConfig.Read.All". This API only works with delegated permissions, see https://docs.microsoft.com/en-us/graph/api/intune-onboarding-onpremisesconditionalaccesssettings-get?view=graph-rest-1.0#prerequisites.

If the above steps do not resolve the issue, I would then recommend you open a support ticket/question here https://developer.microsoft.com/en-us/graph/support for the appropriate team to investigate.

[peombwa]

Closing due to inactivity. Please reopen if the error persists.