createDeviceLogCollectionRequest : bad request

DAMIEN VAN ROBAEYS 6 MVP

Hello,
When I try the action createDeviceLogCollectionRequest from graph explorer I have an errer bad request.
I use the below query:
https://graph.microsoft.com/beta/deviceManagement/managedDevices('e5bb60c1-be49-44d6-be9a-888a412621b5')/createDeviceLogCollectionRequest

This one sems correct, because when I run the action from the endpoint manager portal, F12 dev part gives me this URL with method POST.

However when I run it from graph explorer, I have an error.

2 answers

DAMIEN VAN ROBAEYS 6 Reputation points MVP

2021-07-09T13:53:05.29+00:00

Hello,
I have been confimed by someone who has been in contact with a guy in MS that

Running diagnostics from outside of the MEM console is in their backlog meaning it's not available out of the intune portal.

Any chances that it will soon possible ?
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment
Crystal-MSFT 43,736 Reputation points Microsoft Vendor

2021-03-03T04:22:48.943+00:00

@DAMIEN VAN ROBAEYS , Doing research and find an article in GitHud describe the createDeviceLogCollectionRequest action.
https://github.com/microsoftgraph/microsoft-graph-docs/blob/master/api-reference/beta/api/intune-devices-manageddevice-createdevicelogcollectionrequest.md

We can read the above articles to see if it can help. If the issue persists, as Q&A is with limitation resource, we suggest to contact Intune support to get more help:
https://learn.microsoft.com/en-us/mem/get-support

Thanks for the understanding and have a nice day!

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
DAMIEN VAN ROBAEYS 6 Reputation points MVP

2021-03-03T07:32:16.747+00:00

Actually when you collect logs from the portal using the developper mode, the process works as below:

When you click on the Collect diagnostics (from the top bar) this will run the below query:
POST https://graph.microsoft.com/beta/deviceManagement/managedDevices('a9ea6d32-bd1c-4222-8322-88d1b1aad256')/createDeviceLogCollectionRequest

DAMIEN VAN ROBAEYS 6 Reputation points MVP

2021-03-03T07:33:19.267+00:00

Then when you click on Device diagnostics (from the side bar) this will run the below query:
GET https://graph.microsoft.com/beta/deviceManagement/managedDevices('a9ea6d32-bd1c-4222-8322-88d1b1aad256')/logCollectionRequests

Then you have the log to download. Once you click on the Download button, this will run the below query:
POST https://graph.microsoft.com/beta/deviceManagement/managedDevices('a9ea6d32-bd1c-4222-8322-88d1b1aad256')/logCollectionRequests('e5dc5f80-550a-4b9f-8404-849a72e828ba')/createDownloadUrl

DAMIEN VAN ROBAEYS 6 Reputation points MVP

2021-03-03T07:33:40.04+00:00

In my case i'm looking for the 1st step (for now)
If you check the createDeviceLogCollectionRequest documentation this will give the same query than this one used from developper mode:
https://learn.microsoft.com/en-us/graph/api/intune-devices-manageddevice-createdevicelogcollectionrequest?view=graph-rest-beta

Crystal-MSFT 43,736 Reputation points Microsoft Vendor

2021-03-03T09:46:43.017+00:00

@DAMIEN VAN ROBAEYS ,, Sorry for deleting one reply from you with mistake. Add it in this reply :

=========================================================

DAMIENVANROBAEYS-8458 Crystal-MSFT
yres the GitHub article is he same than this one from MS Doc i shared.
According to me, it's not only relative with powershell. In my case I do it first from Graph Explorer.
I always use Graph Explorer before using PowerShell.

=========================================================

Yes, you are right. They are the same. And I notice we have submitted the issue as well on GitHub. We can wait to see if there's any update on it.

@Jason Sandys , Did you have any suggestion on this? Thanks for the help in advance.

DAMIEN VAN ROBAEYS 6 Reputation points MVP

2021-03-04T12:01:30.57+00:00

Hello, it seems something relative to the token.
From Graph Explorer and Intune PowerShell module it doesn't work.
IIn the developer mode from chrome, when you the action from the intune portal, if you check the token authentification barer, this one is different from this one used in graph explorer.

Crystal-MSFT 43,736 Reputation points Microsoft Vendor

2021-03-05T07:05:45.06+00:00

@DAMIEN VAN ROBAEYS ,, Thanks for the reply. If we add the token under chrome into the token under Graph explorer. Will it successful? How about the result when we change the device ID to another one which didn't collect log before?

DAMIEN VAN ROBAEYS 6 Reputation points MVP

2021-03-05T07:38:04.82+00:00

How to add it into Graph Explorer ?
On Chrome with the developer mode, when you do a right click on createDeviceLogCollectionRequest you have the possibility to copy as powershell.
This will give something as below:

Invoke-WebRequest -Uri "https://graph.microsoft.com/beta/deviceManagement/managedDevices('e5bb60c1-be49-44d6-be9a-888a412621b5')/rebootNow" -Method "POST"
-Headers @{
"Authorization"="Bearer token base64 code"
}

If I use it in powershell this works and correctly initiate the log collection and works also for other devices.

DAMIEN VAN ROBAEYS 6 Reputation points MVP

2021-03-05T11:14:47.733+00:00

I compared both tokens and there are some differences. I used the same user for authentication.

From Graph explorer and powershell I don't have the below permissions displayed:
DeviceManagementServiceConfiguration.ReadWrite.All
I enabled it but it still doesn't appears in my token from graph explorer.

From the intune portal I have below info:
app_displayname Microsoft Intune portal extension
aud https://graph.microsoft.com/

From Graph Explorer I have this one:
app_displayname Graph explorer (official site)
aud 00000003-0000-0000-c000-000000000000

Crystal-MSFT 43,736 Reputation points Microsoft Vendor

2021-03-08T05:46:27.84+00:00

@DAMIEN VAN ROBAEYS ,Based on my research, if you are trying to call https://graph.microsoft.com or any of it's APIs, we need a token with the aud claim of https://graph.microsoft.com or 00000003-0000-0000-c000-000000000000. From the information we get, both aud are correct. We can see more details in the following link:
https://stackoverflow.com/questions/46101980/call-microsoft-graph-api-using-azure-ad-1-0-endpoint-client-credentials-flow
Note: Non-Microsoft link, just for the reference.

For token under Graph explorer, we can try to add the token under Request Headers to see if it is working.

DAMIEN VAN ROBAEYS 6 Reputation points MVP

2021-03-08T09:13:12.513+00:00

Thanks for the answer. I get an error: InvalidAuthenticationToken
Can you reproduce the collect logs behavior from Graph Explorer and PowerShell ?
That's weird that other actions like setdevicename, rebootnow... work correctly

Crystal-MSFT 43,736 Reputation points Microsoft Vendor

2021-03-09T02:32:58.437+00:00

@DAMIEN VAN ROBAEYS ,, Thanks for the reply. For log analytics, I find this needs Azure subscription. With Q&A limitation, I only have Intune subscription and didn't have Azure subscription. Currently, I can't test this for you. Sorry for the inconvenience for you. Here, we suggest to open case which has more resource to get more help.
https://learn.microsoft.com/en-us/mem/get-support

Thanks for your understanding.

DAMIEN VAN ROBAEYS 6 Reputation points MVP

2021-03-09T06:35:20.33+00:00

Actually I was not talking about log analytics but the same part than didn't work for me from both graph explorer and powershell, the device action collecting diagnostics (which collects logs from the deivce)

Crystal-MSFT 43,736 Reputation points Microsoft Vendor

2021-03-09T06:56:12.387+00:00

@DAMIEN VAN ROBAEYS , Would like to double confirm if we talk about the following part?

DAMIEN VAN ROBAEYS 6 Reputation points MVP

2021-03-09T07:12:40.607+00:00

Nope, in my case it's an Intune feature.
It's located in Devices > All devices > select a device > on the top bar click on ... > Collect diagnostics.
Then logs are available in Devices > All devices > go to the device > on the sidebar > Device diagnostics

Crystal-MSFT 43,736 Reputation points Microsoft Vendor

2021-03-09T08:10:15.993+00:00

@DAMIEN VAN ROBAEYS , Thanks for the confirmation. Based on my test with PowerShell. I get the following error

Invoke-WebRequest -Uri "https://graph.microsoft.com/beta/deviceManagement/managedDevices('3053b167-5dc9-4404-93c7-3edfcc8e0c94')/createDeviceLogCollectionRequest"; -Method "POST" -Headers @{"authorization"="Bearer <token I get from F12>"}

DAMIEN VAN ROBAEYS 6 Reputation points MVP

2021-03-09T08:12:47.497+00:00

I got the same, and if you try directly from graph explorer with just the URI and method POST ? you should have the badrequest error

Crystal-MSFT 43,736 Reputation points Microsoft Vendor

2021-03-09T08:17:47.063+00:00

@DAMIEN VAN ROBAEYS , I will do more research on this to see if I can find out the right method to get the information from graph.

DAMIEN VAN ROBAEYS 6 Reputation points MVP

2021-03-09T08:23:14.727+00:00

Thanks :-)

Crystal-MSFT 43,736 Reputation points Microsoft Vendor

2021-03-10T09:22:39.173+00:00

@DAMIEN VAN ROBAEYS , I have tested with Powershell again and find it works now:

For the Graph Explorer, after discussing internally, it can be some known issue in the background. We will try our best to feedback. If I can get any update, I will post back.

At the same time, we also suggest to open a case which is more efficient channel to work on such issue.

Thanks for your understanding and have a nice day!

DAMIEN VAN ROBAEYS 6 Reputation points MVP

2021-03-10T09:36:33.317+00:00

Actually, indeed with the token provided from F12 it worked, i already tested. Yu can also do a right click from F12 and a context menu copy as powershell let you copy the command.
The issue is from powershell with the Microsoft.Graph.Intune module which have the same issue than from Graph Explorer.
I will also open a case, thx

Crystal-MSFT 43,736 Reputation points Microsoft Vendor

2021-03-10T09:42:07.843+00:00

@DAMIEN VAN ROBAEYS Yes you are right. In my previous test in Powershell, there's a symbol included which cause the failure. And when I remove it , it works.

If it is fixed after opening a case. I appreciate you can share the information here. Thanks for your time and have a nice day!
Sign in to comment