Unauthorized (401) listing synchronization jobs for service principal in MS Graph API

Question

I am trying to use MS Graph API to configure Azure AD Connect Cloud Sync from these [instructions][1] but I am having trouble calling this [endpoint][2] in Powershell using client credentials: https://graph.microsoft.com/beta/servicePrincipals/{SERVICE_PRINCIPAL_ID}/synchronization/jobs I can successfully call this using the Graph Explorer, but no luck using Application permission and authentication with a client secret in Powershell. I get 401 Unauthorized error. I can call other endpoints like: https://graph.microsoft.com/beta/servicePrincipals/{SERVICE_PRINCIPAL_ID} # no /synchronization/jobs at the end The application has the API permission: Directory.ReadWrite.All (Application) The permission has been granted by the admin: ![126191-image.png][3] Below is the detail of the code I use to authenticate: $Body = @{ 'tenant' = $TenantId 'client_id' = $ClientId 'scope' = 'https://graph.microsoft.com/.default' 'client_secret' = $ClientSecret 'grant_type' = 'client_credentials' } $Params = @{ 'Uri' = "https://login.microsoftonline.com/$TenantId/oauth2/v2.0/token" 'Method' = 'Post' 'Body' = $Body 'ContentType' = 'application/x-www-form-urlencoded' } $AuthResponse = Invoke-RestMethod @Params And this is how I call the endpoint: $Headers = @{ 'Authorization' = "Bearer $($AuthResponse.access_token)" } $Params = @{ Uri = "https://graph.microsoft.com/beta/servicePrincipals/{SERVICE_PRINCIPAL_ID}/synchronization/jobs" Method = 'Get' ContentType = 'application/json' Headers = $Headers } $res = Invoke-RestMethod @Params And the error: Invoke-RestMethod : The remote server returned an error: (401) Unauthorized If I use the token from the Graph Explorer it works... My token from Powershell decoded contains this "roles" section but no "scp" like in the Graph Explorer token: "roles": [ "Directory.ReadWrite.All" ], Thank you for your help! [1]: https://learn.microsoft.com/en-us/azure/active-directory/cloud-sync/how-to-inbound-synch-ms-graph [2]: https://learn.microsoft.com/en-us/graph/api/synchronization-synchronizationjob-list?view=graph-rest-beta&tabs=http [3]: /api/attachments/126191-image.png?platform=QnA

Answer 1

EDIT: The service principal needs the role "Hybrid Identity Administrator" (or Global administrator) for this to work!

Another way with user creds, ROPC flow (username/password) this user also needs Hybrid Identity Admin role:

$Body = @{
'tenant' = $TenantId
'client_id' = $ClientId
'scope' = 'https://graph.microsoft.com/.default'
'username' = $Username
'password' = $Password
'grant_type' = 'password'
}
$Params = @{
'Uri' = "https://login.microsoftonline.com/$TenantId/oauth2/v2.0/token"
'Method' = 'Post'
'Body' = $Body
'ContentType' = 'application/x-www-form-urlencoded'
}
$AuthResponse = Invoke-RestMethod @Params

Answer 2

Did you ever solve this one?