Forum Discussion

Alex_Rechs's avatar
Alex_Rechs
Brass Contributor
Feb 10, 2023
Solved

Calling principal does not have required MSGraph permissions AuditLog.Read.All

I have a Runbook (Automation Accounts) parsing AAD SignIn and Audit logs, however, when it executes Get-AzureADAuditSignInLogs I'm getting the following error: Get-AzureADAuditSignInLogs : Error occ...
msgraph
powershell
PowerShell Graph SDK
runbook
  • VasilMichev's avatar
    VasilMichev
    Feb 12, 2023
    It isn't, you should add/consent to the AuditLog.Read.All permission.
VasilMichev's avatar
VasilMichev
MVP
Feb 12, 2023
It isn't, you should add/consent to the AuditLog.Read.All permission.
  • roystonius's avatar
    roystonius
    Copper Contributor
    Aug 17, 2023

    VasilMichev This is a terrible response and you get 'best answer' for this? Not helpful at all.

  • Chris2705's avatar
    Chris2705
    Copper Contributor
    Jul 28, 2023

    VasilMichev 
    Can you please elaborate the answer ? the steps are not straightforward. I suppose this is involving the creation of a new app.

    • roystonius's avatar
      roystonius
      Copper Contributor
      Aug 17, 2023
      Chris2705 I'm trying to work this out myself at the moment. There is a known bug documented at
      https://github.com/microsoftgraph/msgraph-sdk-powershell/issues/108

      I'll post an actual technical answer here when i find it 🙂
      • Chris2705's avatar
        Chris2705
        Copper Contributor
        Aug 17, 2023

        roystonius 

        I solved the issue giving the Graph permission without registering any app, and with a small powershell script.
        Please follow this article and you'll be able to solve it as well.

        https://gotoguy.blog/2022/03/15/add-graph-application-permissions-to-managed-identity-using-graph-explorer/

        Unfortunately graph api permissions are something different than Azure AD roles.

Resources