Title

Troubleshoot failures connecting to Microsoft 365 APIs

This article provides a structured approach to troubleshooting connection failures to Microsoft 365 APIs when using the Flexera One ITAM/FlexNet Manager Suite Microsoft 365 inventory adapter.

Error symptoms

Below is an example of error details that may appear in the logs when a beacon fails to connect to Microsoft 365 APIs. The troubleshooting steps in this article can help resolve these issues.

2024-12-14 03:27:55,148 [INFO ] Reading 'Computer' data from 'M365_Connection' (ver 1.0) data source
2024-12-14 03:27:55,148 [INFO ] Get Users from Office 365 (Transfer data from source 'M365_Connection' to FNMP)
2024-12-14 03:27:56,938 [ERROR] System.Net.WebException: The remote server returned an error: (400) Bad Request.
at Microsoft.PowerShell.Commands.WebRequestPSCmdlet.GetResponse(WebRequest request)
at Microsoft.PowerShell.Commands.WebRequestPSCmdlet.ProcessRecord()
2024-12-14 03:27:56,938 [ERROR] Microsoft.PowerShell.Commands.WriteErrorException: Error occurred trying to get the access token: Get-TokenSetInternal failed
2024-12-14 03:27:57,019 [INFO ] #ObjectModel_User_GetUsersfromOffice365
2024-12-14 03:27:58,039 [INFO ] Failed to execute Reader 'Get Users from Office 365' from file C:\ProgramData\Flexera Software\Compliance\ImportProcedures\Inventory\Reader\microsoft 365\User.xml, at step line 1
Error: The remote server returned an error: (400) Bad Request.

Troubleshooting steps

To diagnose and resolve connection failures, follow these steps using PowerShell to attempt a connection to the Microsoft 365 API, optionally through a web proxy. The statements below perform the same operations as the Microsoft 365 inventory adapter when it makes a connection to the API.

As you work through these steps:

Execute these commands in a Windows PowerShell 5.x window (not PowerShell 7.x).
Check for any errors in the output. Use the error details to guide further investigation. This may involve searching online for solutions or consulting with personnel who support Microsoft 365 or the network environment.
It may be helpful to refer to details configured in the Microsoft 365 connection in the beacon UI. The relevant UI dialog for configuring the connection details looks like this:

Step 1: Retrieve connection details

Option 1: Retrieve details from the beacon UI

If your beacon has a Microsoft 365 inventory connection configured, use the following PowerShell commands to retrieve the connection details. This avoids re-entering the details or if you're unsure of them.

Replace "M365" in the first line of the script with your actual connection name.

NOTE: Use option two instead if you want to manually enter details in response to PowerShell prompts.

$connectionName = "M365"

if ($PSVersionTable.PSEdition -ne "Desktop") {
    Write-Error "This script must be run in a Windows PowerShell 5.x window (not a PowerShell 7.x window). Please open a Windows PowerShell window and re-run." -ErrorAction Stop
}

$beaconInstallPath = Get-ItemPropertyValue -Path "HKLM:\SOFTWARE\WOW6432Node\ManageSoft Corp\ManageSoft" -Name ETDPInstallDir

if (!$beaconInstallPath) {
    Write-Error "Could not find beacon installation path. Are you running this on a beacon?" -ErrorAction Stop
}

Add-Type -Path "$beaconInstallPath\DotNet\bin\Flexera.Beacon.Common.dll"

$connection = ([Flexera.Beacon.Common.BeaconDataLayerFactory]::Create()).LoadConfigurations().GetConnectionsByName($connectionName)

if (!$connection) {
    Write-Error "No connection with name '$connectionName' found" -ErrorAction Stop
}

# Build hash table of parameters for lookup
$params = @{}; $connection.RemoteConnectionParameters | %{ $params[$_.Name] = $_.Value }

Option 2: Manually enter connection details

You can manually enter the connection parameter details instead of retrieving them from the beacon UI. Take this approach if you are not working on a beacon with a Microsoft 365 connection already configured or if you want to use different parameter values from what is configured for the beacon’s connection.

$params = @{}

$params.proxyServer = Read-Host "Enter web proxy URL (example: http://my-proxy:8080), or leave blank if no proxy is needed"

if ($params.proxyServer) {
    $params.proxyUsername = Read-Host "Enter username for web proxy authentication, or leave blank if no authentication is required"

    if ($params.proxyUsername) {
        $params.proxyPassword = (Get-Credential $params.proxyUsername -Message "Enter password for web proxy authentication").GetNetworkCredential().Password
    }
}

$params.TokenEndpoint = Read-Host "Enter Token Endpoint (example: https://login.microsoftonline.com/common/oauth2/v2.0/token)"

$params.ClientID = Read-Host "Enter Application (client) ID (example: 5bb1a5a2-0d97-4335-9448-119f7b27aff9)"

$useAuthCode = (Read-Host "Use Authorization Code authentication flow? (Y or N)").ToUpper()

if ($useAuthCode[0] -eq "Y") {
    $params.AuthType = "Authorization Code"

    $params.RedirectUrl = Read-Host "Enter Redirect URL (example: https://login.microsoftonline.com/common/oauth2/nativeclient)"

    $params.AuthorizationEndpoint = Read-Host "Enter Authorization Endpoint (example: https://login.microsoftonline.com/common/oauth2/v2.0/authorize)"

    $params.RefreshToken = Read-Host "Enter Refresh Token"
} else {
    $params.AuthType = "Client Credentials"

    $params.ClientSecret = Read-Host "Enter Client Secret"
}

Step 2: Configure web proxy (if required)

If you need to use a web proxy to connect to the Microsoft 365 APIs, configure the web proxy in your current PowerShell session with these commands:

if ($params.proxyServer) {
    [System.Net.WebRequest]::DefaultWebProxy = New-Object System.Net.WebProxy($params.proxyServer)

    if ($params.proxyUsername) {
        $credCache = New-Object System.Net.CredentialCache

        $cred = New-Object System.Net.NetworkCredential($params.proxyUsername, $params.proxyPassword)

        $credCache.Add($params.proxyServer, "Basic", $cred)

        [System.Net.WebRequest]::DefaultWebProxy.Credentials = $credCache
    }
}

Step 3: Obtain Microsoft 365 access token and user data

Execute the following to initiate a connection to the Microsoft 395 API and obtain an access token:

Write-Output "Connecting to Microsoft 365 API using the following parameters:"

$params

if ($params.AuthType -eq "Authorization Code") {
    $tokenArgs = @{
        client_id = $params.ClientID
        redirect_uri = $params.RedirectUrl
        refresh_token = $params.RefreshToken
        grant_type = "refresh_token"
    }
} else {
    $tokenArgs = @{
        client_id = $params.ClientID
        scope = "https://graph.microsoft.com/.default"
        client_secret = $params.ClientSecret
        grant_type = "client_credentials"
    }
}

[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12

$response = Invoke-RestMethod -Uri $params.TokenEndpoint -Method POST -ContentType "application/x-www-form-urlencoded" -Body $tokenArgs

if (-not $response.access_token) {
    Write-Error "No access token returned" -ErrorAction Stop
}

Write-Host "Access token successfully obtained"

$headers = @{
    Authorization = "Bearer $($response.access_token)"
    ContentType = "application/json"
    ConsistencyLevel = "eventual"
}

Step 4: Call additional API endpoints to query data

After obtaining an access token, calls can be made to Microsoft 365 APIs endpoints to query data as appropriate for your troubleshooting need.

Here are some examples.

To query some user data:

$result = Invoke-RestMethod -Method GET -Uri 'https://graph.microsoft.com/v1.0/Users?$select=id,givenName,surname,userPrincipalName,assignedLicenses&$top=2&$count=true' -Headers $headers

Write-Output "Returned result with $($result."@odata.count") users"

Write-Output "First users in result set:"

$result.value

To query subscribed SKUs:

$result = Invoke-RestMethod -Method GET -Uri 'https://graph.microsoft.com/v1.0/subscribedSkus' -Headers $headers

Write-Output "Returned result with $($result.value.Count) subscribed SKUs"

Write-Output "Subscribed SKUs:"

$result.value

Learn more

See Microsoft 365 Adapter for more details about the Microsoft 365 adapter.

Was this helpful?

Support Hub

Product

FlexNet Manager Suite

Products	Region	Phone Numbers
FlexNet Operations FlexNet Embedded FlexNet Publisher FlexNet Connect FlexNet Code Insight InstallAnywhere InstallShield	North America *	+1 630-332-2513 (toll) +1 877-279-2853 (toll-free in North America)
	Europe *	+44 1925 944367 (toll) +44 800 047 8642 (toll-free in Europe)
	Japan *	+81 3-4540-5335 (select option 2)
	Australia *	+61 3 9895 2177 +61 1800 560 603 (toll-free in Australia)
Usage Intelligence (formerly Revulytics) Compliance Intelligence	Please use the Case Portal to submit your support ticket or reach out to your Revenera contact.

Error symptoms

Troubleshooting steps

Step 1: Retrieve connection details

Option 1: Retrieve details from the beacon UI

Option 2: Manually enter connection details

Step 2: Configure web proxy (if required)

Step 3: Obtain Microsoft 365 access token and user data

Step 4: Call additional API endpoints to query data

Files

Please wait...

Error symptoms

Troubleshooting steps

Step 1: Retrieve connection details

Option 1: Retrieve details from the beacon UI

Option 2: Manually enter connection details

Step 2: Configure web proxy (if required)

Step 3: Obtain Microsoft 365 access token and user data

Step 4: Call additional API endpoints to query data

Related Articles

Please wait...

Case id: 00001065