Azure Question posted in
The official documentation to get you started can be found here.

Azure Government Get incidents returns 401 Forbidden

I am trying to get the Incidents using the Azure Government Cloud as described here: https://learn.microsoft.com/en-us/rest/api/securityinsights/incidents/list?view=rest-securityinsights-2024-09-01&tabs=HTTP

Request to get the token:

curl --location 'https://login.microsoftonline.us/TENANT_ID/oauth2/v2.0/token' 
--header 'Content-Type: application/x-www-form-urlencoded' 
--data-urlencode 'client_id=CLIENT_ID' 
--data-urlencode 'client_secret=CLIENT_SECRET' 
--data-urlencode 'grant_type=client_credentials' 
--data-urlencode 'scope=https://management.usgovcloudapi.net//.default'

Reponse:

{"token_type":"Bearer","expires_in":3599,"ext_expires_in":3599,"access_token":"..."}

Request to get the incidents:

curl --location 'https://management.usgovcloudapi.net/subscriptions/SUBSCRIPTION_ID/resourceGroups/GROUP_NAME/providers/Microsoft.OperationalInsights/workspaces/WORKSPACE_NAME/providers/Microsoft.SecurityInsights/incidents?api-version=2024-04-01-preview&$filter=(properties/lastModifiedTimeUtc ge 2024-12-20T10:23:00Z and properties/lastModifiedTimeUtc le 2024-12-20T10:25:00Z)&$top=100' 
--header 'Authorization: Bearer ey...'

Response: 401 Forbidden

The same API calls work properly for Global Azure (management.azure.com) and the incidents are returned.

Tags:

2

Answers


  1. Chosen as BEST ANSWER
    0

    Thank you Venkatesan! Adding the role Microsoft Sentinel Contributor to the app solved the issue!


  2. 0

    Azure Government Get incidents returns 401 Forbidden

    The above error occurs when you don’t have proper permission or passing incorrect values in the Rest API URL.

    Assign Reader or Microsoft Sentinel Contributor role to your Azure service principal under subscription to get the incident.

    Portal:

    enter image description here

    Also, you’re using the 2024-04-01-preview API version in the incidents query, but the documentation you shared references 2024-09-01. Please make sure to use the correct API version

    enter image description here

    Now you can try with request with proper values and permission in your environment,

    Reference:
    Incidents – List – REST API (Azure Sentinel) | Microsoft Learn

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search