Unable to remove from AzureAD

[Pirana-NL]

I have issues using this script.
It successfully removes the devices from Intune and Autopilot, but when it tries to delete the device from Azure I get an error.
I think it is because the device is not yet fully deleted from Intune.

When I try to run the script a second time (after a few minutes) it doesn't find the device because it cant lookup the deviceid with the serialnumber in autopilot.

could this be fixed ?

(store the deviceID and start this section of the script after x minutes (or manual))

---

Module WindowsAutoPilotIntuneCommunity is available.

Connecting to Microsoft services. Enter your credentials.

Connecting to MgGraph

Version 2 module detected
Connected to Intune tenant
Retrieving all Microsoft Graph devices.

Deleting all devices by serial number.

SerialNumber: PF1HP8UA
DeviceId: 65a5411b-f8e3-4dc4-a440-77ecd33ba4b4
Id: 5098f039-9919-40cf-a816-d81972206a6c
ManagedDeviceId: 2dddb109-45cf-4014-8961-aefb9f774a96

Removing from Intune
Removing from AutoPilot
Removing from AzureAD

Invoke-MgGraphRequest : DELETE https://graph.microsoft.com/beta/devices/cbd2f7b4-55e9-4535-b6df-c4c8a2d46e9a
HTTP/1.1 403 Forbidden
Transfer-Encoding: chunked
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000
request-id: f4125800-7a7d-42b2-bd02-5a2e79edf4d5
client-request-id: 0e9e69cc-7735-41f3-9fad-1598a5c57ae5
x-ms-ags-diagnostic: {"ServerInfo":{"DataCenter":"West Europe","Slice":"E","Ring":"5","ScaleUnit":"002","RoleInstance":"AM2PEPF0001E778"}}
x-ms-resource-unit: 1
Cache-Control: no-cache
Date: Mon, 12 May 2025 08:58:17 GMT
Content-Type: application/json
{"error":{"code":"Authorization_RequestDenied","message":"Insufficient privileges to complete the operation.","innerError":{"date":"2025-05-12T08:58:18","request
-id":"f4125800-7a7d-42b2-bd02-5a2e79edf4d5","client-request-id":"0e9e69cc-7735-41f3-9fad-1598a5c57ae5"}}}
At C:\Users************\removeAutoPilotdevices.ps1:200 char:13

•         Invoke-MgGraphRequest -uri "https://graph.microsoft.com/b ...
  

•         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : InvalidOperation: (Method: DELETE,...nt-Length: 0
    }:HttpRequestMessage) [Invoke-MgGraphRequest], HttpResponseException
  • FullyQualifiedErrorId : InvokeGraphHttpResponseException,Microsoft.Graph.PowerShell.Authentication.Cmdlets.InvokeMgGraphRequest
    Remove-MgDevice : Kan bestand of assembly Microsoft.Graph.Authentication, Version=2.25.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35 of een van de afhank
    elijkheden hiervan niet laden. Het systeem kan het opgegeven bestand niet vinden.
    At C:\Users*************\removeAutoPilotdevices.ps1:201 char:13

•         Remove-MgDevice -DeviceID $mgdevice.id
  

•         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : NotSpecified: (:) [Remove-MgDevice_Delete], FileNotFoundException
  • FullyQualifiedErrorId : Microsoft.Graph.PowerShell.Cmdlets.RemoveMgDevice_Delete

[PBKoning]

I made some changes a while ago but did not change the code in Github.
I've changed it to my most recent (working) version. Does it work now?

[Pirana-NL]

I get this error now

AADSTS700016: Application with identifier '9a9fdd0a-4fe1-42ce-8dcf-f9e5c90344b3' was not found in the directory ...

I think I need to register something

[PBKoning]

I think this page will solve it if you follow the steps: https://learn.microsoft.com/en-us/answers/questions/1659638/weve-detected-a-microsoft-intune-powershell-script

[Pirana-NL]

Thank you, this helped a lot,
The only thing remailing is still te deleting form the Azure devices,
I'm missing something
This is the error i Get

Remove-MgDevice : Insufficient privileges to complete the operation.
Status: 403 (Forbidden)
ErrorCode: Authorization_RequestDenied
Date: 2025-05-16T08:22:36
Headers:
Transfer-Encoding : chunked
Vary : Accept-Encoding
Strict-Transport-Security : max-age=31536000
request-id : 17cfb813-b167-4e1a-831e-3979fce9f912
client-request-id : 94b309d3-cfff-4c81-ab91-cc7d87af4d00
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"West Europe","Slice":"E","Ring":"5","ScaleUnit":"003","RoleInstance":"AM1PEPF000520AE"}}
x-ms-resource-unit : 1
Cache-Control : no-cache
Date : Fri, 16 May 2025 08:22:36 GMT
At C:\Users***\removeAutoPilotdevices.ps1:108 char:13

•         Remove-MgDevice -DeviceID $mgdevice.id
  

•         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : InvalidOperation: ({ DeviceId = d8... , Headers = }:<>f__AnonymousType92`3) [Remove-MgDevice_Delete], Exception
  • FullyQualifiedErrorId : Authorization_RequestDenied,Microsoft.Graph.PowerShell.Cmdlets.RemoveMgDevice_Delete

I guess i miss one thing
these are the permissions i configured

What did i miss?

AccessReview.ReadWrite.All

Device.Read.All

DeviceManagementApps.ReadWrite.All

DeviceManagementConfiguration.ReadWrite.All

DeviceManagementManagedDevices.PrivilegedOperations.All

DeviceManagementManagedDevices.ReadWrite.All

DeviceManagementRBAC.ReadWrite.All

DeviceManagementServiceConfig.ReadWrite.All

Directory.AccessAsUser.All

Directory.Read.All

Group.ReadWrite.All

openid

PlaceDevice.ReadWrite.All

TeamworkDevice.ReadWrite.All

User.Read

[PBKoning]

Can you try: Connect-MgGraph -Scopes "Directory.AccessAsUser.All" on line 48? Does that work?

[Pirana-NL]

Yes, that works fine,

thanks for your help

[PBKoning]

Glad to hear that it works 👍