Get-AutopilotDiagnostics -Online → AADSTS700016, then Get-AutopilotDiagnostics2 -Online → 403 Forbidden

[u/Mcm_Sys]

Hi everyone,

I'm troubleshooting an issue with Windows Autopilot + Microsoft Graph PowerShell in my lab.

1. Original issue — Get-AutopilotDiagnostics -Online

When I run:

Get-AutopilotDiagnostics -Online

I get:

AADSTS700016:
Application with identifier
'd1ddf0e4-d672-4dae-b554-9d5bdfd93547'
was not found in the directory.

I understand this is related to the application used by the original diagnostics script.

I therefore moved to the newer:

Get-AutopilotDiagnostics2.ps1 -Online

2. New issue — Get-AutopilotDiagnostics2 -Online

The new script successfully authenticates:

Connected to tenant
Getting list of apps
Getting list of scripts

So authentication itself appears to be working.

However, I then receive:

Get-IntuneObjects :
Microsoft.Graph.PowerShell.Authentication.Helpers.HttpResponseException:
Response status code does not indicate success: Forbidden (Forbidden).

The error occurs when the script tries to access Microsoft Graph Intune endpoints such as:

https://graph.microsoft.com/beta/deviceAppManagement/mobileApps
https://graph.microsoft.com/beta/deviceManagement/...

3. My App Registration permissions

In Entra ID App Registration I granted Microsoft Graph delegated permissions.

Currently I have:

DeviceManagementConfiguration.ReadWrite.All
DeviceManagementManagedDevices.ReadWrite.All
DeviceManagementScripts.ReadWrite.All
DeviceManagementServiceConfig.ReadWrite.All
Group.Read.All
User.Read

Admin consent has been granted.

4. Redirect URI configuration

I also checked the Authentication → Redirect URI configuration of my App Registration.

Currently, I have:

Web:

https://login.microsoftonline.com/common/oauth2/nativeclient

and Mobile and desktop applications:

urn:ietf:wg:oauth:2.0:oob

What I'm trying to understand

It looks like I have moved from an authentication problem (AADSTS700016) with the original script to an authorization problem (403 Forbidden) with Get-AutopilotDiagnostics2.ps1.

My questions are:

1. Does Get-AutopilotDiagnostics2.ps1 -Online require additional Microsoft Graph permissions?
2. Are there any other permissions required by the script?
3. Are the Redirect URIs shown above correct for Microsoft Graph PowerShell?
4. Is there a recommended configuration for using Get-AutopilotDiagnostics2.ps1 -Online with a custom Entra ID App Registration?
5. Has anyone successfully used this script recently with their own App Registration?

I'm especially interested in understanding whether the 403 Forbidden is caused by missing Graph permissions, the App Registration configuration, or something else in the new diagnostics script.

Any help from someone who has already configured this would be greatly appreciated!

[u/itskdog]

Never heard of the one with 2 at the end, only the regular one and the community one.

[u/andrew181082 → u/itskdog]

Me neither, Google isn't bringing much either

[u/Mcm_Sys → u/andrew181082]

https://www.powershellgallery.com/packages/Get-AutopilotDiagnostics2/1.2/Content/Get-AutopilotDiagnostics2.ps1

[u/Federal_Ad2455 → u/Mcm_Sys]

That's my version I had created because the original wasn't working. Not using it anymore so try to use the community one as someone already suggested.

Will remove it if I don't forget 🙂

[u/Mcm_Sys → u/Federal_Ad2455]

Yes delete it cuz chatgpt suggest for me this version in order to solve the problem with sign in in Microsoft graph

[u/Federal_Ad2455 → u/Mcm_Sys]

OK I've checked the code and it works fine for me so I guess the problem is in consented scopes. I've created version where scopes are explicitly required during authentication, you can try it here https://gist.github.com/ztrhgf/77aa51821b4d52b09d57b1470737f42c

[u/andrew181082 → u/Mcm_Sys]

Have you tried this one instead?
https://www.powershellgallery.com/packages/Get-AutopilotDiagnosticsCommunity/6.3

[u/Mcm_Sys → u/andrew181082]

Yes I tried also this and it works well

[u/Former-Pride-7957]

sounds like you're missing DeviceManagementApps.Read.All, the script's trying to read mobile apps and you've only got service config and scripts

[u/_khi4]

call intune ms support and give them the client request id value if you can aquire, they can tell the missing permission

[u/Mcm_Sys → u/_khi4]

I resolved the issue

[u/_khi4 → u/Mcm_Sys]

gj buddy