CODEWITHSUNDEEP
powershellrestmicrosoft-graph-api
Jason Lamb
Jason Lamb

Reputation: 3

Using Microsoft Graph API in PowerShell to Get Planner Tasks

I am trying to use the Microsoft Graph API with Application registration and permissions to modify Planner Tasks. I have successfully registered my application and set permissions to (Directory.Read.All, Directory.ReadWrite.All, Group.Read.All, Group.ReadWrite.All, GroupMember.Read.All, GroupMember.ReadWrite.All, User.Read). but I can't pull the Plans for any group I always get the error:

> Invoke-RestMethod : {   "error": {
>     "code": "UnknownError",
>     "message": "UserDeleted",
>     "innerError": {
>       "request-id": "043b140e-aa18-42aa-8672-7c164277553f",
>       "date": "2020-05-16T22:47:10"
>     }   } } At C:\Users\jlamb\Scripts\Connect-MicrosoftGraph.ps1:36 char:17
> + ... $Response = Invoke-RestMethod -Method Get -Headers $headers -Uri $uri ...
> +                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>     + CategoryInfo          : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-RestMethod],
> WebException
>     + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeRestMethodCommand

I don't understand what this error means. Here is my sample code:

$tenant = '67a80b53-1b4f-4278-b269-xxxxxxxxxxxx' #Directory ID
$client_id = 'da398f63-3b2b-4dc3-b594-54cbc0a2924f' #Application ID
$scope = 'https://graph.microsoft.com/.default'
$client_secret = 'xxxxx-xxxx.xxxxxxx.xxxxxxxxxxx.xxx' #PowerShellPOC, expires 5/16/2021
$grant_type = 'client_credentials'

if (-not $headers) {
    $body = @{client_id=$client_id; scope=$scope; client_secret=$client_secret; grant_type=$grant_type}

    $uri = "https://login.microsoftonline.com/$tenant/oauth2/v2.0/token"

    $Response = Invoke-RestMethod -Method Post -Uri $uri -Body $body
    $access_token = $Response.access_token

    $headers = @{
        Authorization = "$($Response.token_type) $($Response.access_token)"
        ExpiresOn = $($Response.expires_in)
    }
}


Write-Host "Getting Groups"
$uri = "https://graph.microsoft.com/v1.0/groups?$orderby=displayName"
$Response = $null
$Response = Invoke-RestMethod -Method Get -Headers $headers -Uri $uri
$Response.value |ft id, displayName
#this works and returns 100 groups

foreach ($groupId in $($Response.value.id)) {
    $groupId
    $uri = "https://graph.microsoft.com/v1.0/groups/$groupId/planner/plans"
    $Response = $null
    $Response = Invoke-RestMethod -Method Get -Headers $headers -Uri $uri 
    $Response.value |ft
}

I've also tried pulling tasks from a plan I know exists:

$plan_id = 'zBgxnzXTNEaGeW9Hz1CVSmQAHpg2'
$uri = "https://graph.microsoft.com/v1.0/planner/plans/$plan_id/tasks"
$uri
$Response = $null
$Response = Invoke-RestMethod -Method Get -Headers $headers -Uri $uri 
$Response.value |ft

I get the same error.

Upvotes: 0

Views: 1695

Answers (1)

Alexander Holmeset
Alexander Holmeset

Reputation: 26

I see you are using an app secret, and therefore you are using application permissions that are not supported. Need to be delegated.
Take a look at the Docs pages for the requests, and there you see if app or delegated is supported.

Here you have two ways of getting a token for delegated access: https://gist.githubusercontent.com/leeford/04fc4c2d4404c2a31a172923d9bed8ee/raw/294f2303b306b4bf7a31f1541ff4d59dc5b40ca2/AzureADGraphAPIUserToken.ps1

https://www.lee-ford.co.uk/graph-api-device-code/

Upvotes: 1

Related Questions