[BUG]

[ovidiumro]

Offboarding EntraID devices is not working. Intune works fine and I don't have Autopilot.

This is the error message:

{"error":{"code":"BadRequest","message":"{\r\n "_version": 3,\r\n "Message": "An error has occurred - Operation ID (for customer support): 00000000-0000-0000-0000-000000000000 - Activity ID: 203f176d-d152-4088-bfb4-9dd4bc248ef5 - Url: https://fef.msua01.manage.microsoft.com/DeviceEnrollmentFE/StatelessDeviceEnrollmentFEService/deviceManagement/windowsAutopilotDeviceIdentities?api-version=2024-03-21&$filter=contains(displayName%2c%27BLLP-5CG0206P8Y%27)\",\r\n "CustomApiErrorPhrase": "",\r\n "RetryAfter": null,\r\n "ErrorSourceService": "",\r\n "HttpHeaders": "{}"\r\n}","innerError":{"date":"2025-09-05T13:12:34","request-id":"9eb86c53-e543-4508-b0f8-0552da345f7d","client-request-id":"203f176d-d152-4088-bfb4-9dd4bc248ef5"}}}
2025-09-05 09:12:46 - Starting offboarding for device: BLLP-5CG0206P8Y (Serial: )
2025-09-05 09:12:46 - Error removing device BLLP-5CG0206P8Y from Entra ID: DELETE https://graph.microsoft.com/v1.0/devices/8fb1be8c-948d-4b04-b22f-3249abf14f1c
HTTP/2.0 403 Forbidden
Cache-Control: no-cache
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000
request-id: 77c0b5d0-4263-4cf3-abc3-6bf393b90338
client-request-id: 9a92daca-faca-42b8-9ffc-b8a858a0ba0d
x-ms-ags-diagnostic: {"ServerInfo":{"DataCenter":"Canada East","Slice":"E","Ring":"3","ScaleUnit":"000","RoleInstance":"QB1PEPF000110E1"}}
x-ms-resource-unit: 1
Date: Fri, 05 Sep 2025 13:12:46 GMT
Content-Type: application/json

I tried to add "Directory.ReadWrite.All" but still not working.

Everything else is fine

Thanks,
Ovi

[cclifton7]

After connecting to graph, can you click on the prerequisites button and verify all needed permissions are checked?

[ovidiumro]

Yes, all of them are there

[ovidiumro]

Also, everytime I start the script, I get this. Not sure if is related

[cclifton7]

Issue 53 was opened shortly after yours about the same issue. #53

IRT to the Get-InstalledPSResource error, it looks like you downloaded the files and are running the script locally in which case you don't have the script installed. The script has a function that will check the installed version to see if an update is available which doesn't appear to work if you run locally.

Regardless, I wouldn't think this would cause the forbidden error.

[ovidiumro]

Did uninstall, then reinstall
Run the script again and this time I don't have all the prerequisite active:

Any advice?

Ovi

[cclifton7]

Double check you have the required permissions approved in your tenant.

[ovidiumro]

Hi Casey,

All good now. I deleted the App from Entra and when I run the script again it was recreated and now all works fine
Not sure why this happened, but it was on me
So you can mark this as fixed

Thanks, a lot for the support

Ovi