Error 403 Forbidden when connect to Microsoft Defender API

Yu Feng Ong 6

Hi all

I am trying to connect to Microsoft Defender API using Elastic Filebeat. I followed the instructions here exposed-apis-create-app-webapp register a new application with granted permission.

However, when trying to call the api, i encountered this message:

Error while processing http request: failed to execute http client.Do: server responded with status code 403:
{"error":{"code":"Forbidden","message":"The application does not have any of the required application permissions
(Alert.ReadWrite.All, Alert.Read.All, Incident.ReadWrite.All, Incident.Read.All) to access the resource.","target":<target id>}}
{"input_source": "https://api.security.microsoft.com/api/incidents", "input_url": "https://api.security.microsoft.com/api/incidents"}

Can anyone assist me on this ?

Danstan Onyango 3,741 Reputation points Microsoft Employee

2021-05-19T13:52:01.67+00:00

The token must be missing the required permissions. How is the access token generated for your app? Have you pasted the token on jwt.ms and seen the permissions in the response?