Send message to Teams channel when 'Multi Admin Approval' pending or waiting requests

(0) Share

Report

Posted on by CU31030738-0

Hi PA Community

Reaching out to the automate Gurus for some possible help. Recently Microsoft launched the Multi Admin approval in Intune for functions like device wipe / retire / delete, however they did not create any kind of notification flow.

I am trying to create a PA that sends a message to a Teams channel. This command in Graph (https://graph.microsoft.com/beta/deviceManagement/operationApprovalRequests) returns the pending requests, so I was hoping to use this in a scheduled flow to 'get' these and send to Teams. I've started building my flow and I am using an App reg with all the correct application permissions, but it keeps getting a 403 error. Here is the start of my flow:

However, it keeps failing at the HTTP part

{
"_version": 3,
"Message": "An error has occurred - Operation ID (for customer support): 00000000-0000-0000-0000-000000000000 - Activity ID: 775e9bc7******************** - Url: https://proxy.msub06.manage.microsoft.com/StatelessRoleAdministrationFEService/deviceManagement/operationApprovalRequests?api-version=5025-09-12",
"CustomApiErrorPhrase": "",
"RetryAfter": null,
"ErrorSourceService": "",
"HttpHeaders": "{}"
}

If anyone has any ideas, or has already come up with a solution for this, be really happy to hear. Thanks in advance

Categories:

Power Automate Desktop

I have the same question (0)

All responses (10)

Answers (0)

Sort by

RF-31031211-0 6 on at

Like (0)

Report
Copy link

Link copied!

I can confirm also face this same issue, seems application permision doesn't work for resources:
https://graph.microsoft.com/beta/devicemanagement/administrativetasks
and
https://graph.microsoft.com/beta/deviceManagement/operationApprovalRequests

Even all required API permisisons granted :(

Was this reply helpful? Yes No
Mahesh Birudu 28 on at

Like (0)

Report
Copy link

Link copied!

Hello

It appears this may be related to an authentication or permission issue.

Could you please confirm whether the DeviceManagementConfiguration.Read.All permission has been applied and granted admin consent?

Was this reply helpful? Yes No

Sunil Kumar Pashikanti

1,681 Moderator on at

Like (0)

Report

Copy link

Link copied!

Hi @CU31030738-0,

This is a known limitation, not a permissions issue.
The Graph endpoint deviceManagement/operationApprovalRequests does not support application‑only authentication, which is why Power Automate HTTP calls return 403 Forbidden, even with correct permissions and admin consent. The endpoint requires delegated admin context, so it works in Graph Explorer or PowerShell but not in Power Automate cloud flows.

There is currently no supported way to automate Teams notifications for pending Multi‑Admin approvals using Power Automate alone.

Comparison: Why it works in some places but not others

Tool	Authentication Type	Result
Graph Explorer	Delegated (You sign in)	Success
PowerShell	Delegated (Interactive login)	Success
Power Automate	Application (App ID/Secret)	403 Forbidden

Workaround
While there is no "supported" way to do this with standard Power Automate actions, advanced users sometimes use a "Service Account" approach:

They create a dedicated user (Service Account) with a Power Automate Per-User license.

They use a Custom Connector that uses ROPC (Resource Owner Password Credentials) to "impersonate" that user.

Warning: This is generally discouraged by security teams as it bypasses Multi-Factor Authentication (MFA) and is often blocked by Conditional Access policies.

Ref:

Resolve Microsoft Graph authorization errors - Microsoft Graph | Microsoft Learn

Solved: Insufficient privileges to complete the operation

✅ If this answer helped resolve your issue, please mark it as Accepted so it can help others with the same problem.
👍 Feel free to Like the post if you found it useful.

Was this reply helpful? Yes No

RF-31031211-0 6 on at

Like (1)

Report
Copy link

Link copied!

Hi, seems it's working now for Power Automate Application (App ID/Secret), Azure LogicApp (Identity / Application (App ID/Secret).
Tested for https://graph.microsoft.com/beta/deviceManagement/operationApprovalRequests

Was this reply helpful? Yes No
Suggested answer

ninihen 55 on at

Like (0)

Report
Copy link

Link copied!

Tested and it worked in flow. On top of the app resgistraton scope, you need to add Intune RBAC role assignment to the service principle.

To assign, create a security group, add the SP as a member, then Intune admin center -> Tenant admin -> Roles -> create a custom role with:
1. Multi Admin Approval: Read
2. Organization: Read
Then assign to the security group.

Was this reply helpful? Yes No
CU31030738-0 6 on at

Like (0)

Report
Copy link

Link copied!

Hi Ninihen

Thanks for your reply and the information. Sorry to sound like a complete novice, could you possibly provide a bit more information and detail?

I have to use / create a service principal for this and give Delegated permissions instead of application permissions , would it be possible to expand on the flow a bit more please. I really do appreciate it, I'm still fairly new to the Automate world.

Thanks in advance :-)

Was this reply helpful? Yes No
ninihen 55 on at

Like (0)

Report
Copy link

Link copied!

My app registration is DeviceManagementRBAC.Read.All (Application) - you also need to grant admin consent.

Intune RBAC role assignment is from https://intune.microsoft.com/.

From your screenshot, you hardcoded the definition. Your syntax itself is not wrong (I used the same in my flow), but you need to enter them as expression.

Like the Filter array action in your screenshot, the "from" property is correct (

body('Parse_JSON')?['value']) as expression, but filter query property is hardcoded, not expression.

This is mine:

To enter as expression, click on the "fx" and type in the window. Then you should be fine.

Was this reply helpful? Yes No
CU31030738-0 6 on at

Like (0)

Report
Copy link

Link copied!

Hi Ninihen

Thanks for your help again, here is what I have learnt and where I am now stuck. The https://graph.microsoft.com/beta/deviceManagement/operationApprovalRequests only exposes events that are 'expired' or 'completed' and 'pending'. It seems to expose 'NeedaApprooval' actually requires a filter. https://graph.microsoft.com/beta/deviceManagement/operationApprovalRequests?$filter=status eq 'needsApproval'

If I place this in the HTTP it returns no output, but Graph does does see some events

I managed to build the flow all the way to the Team post a message, but the message was empty as its not getting any data. It seems it can see '4' but just not 'Getting' them

Really appreciate any ideas, feel like I am getting there with your help :-)

Was this reply helpful? Yes No
ninihen 55 on at

Like (0)

Report
Copy link

Link copied!

Hi @CU31030738-0, the response in your screenshot shows odata.count: 4, while the value is empty.

This seems to me the filter actually worked (4 requests need approval). And the value not showing may be related to the permission.

Although your service principal is granted the DeviceManagementRBAC.Read.All permission, the service principal account still can only see the request that is relavant to it (either the service principal is the approver, or the requestor).

So theoritically, if you use an app permission, the service principal needs to be assigned an intune admin role that is listed as an approver in the Operation Approval policy in Intune admin center.

Was this reply helpful? Yes No
CU31030738-0 6 on at

Like (0)

Report
Copy link

Link copied!

Thanks for replying on a Sunday. I have given the SP the Intune admin role and the Approvers RBAC in Intune , everything required, and still it will not out put with filter = needsapproval.

Maybe it's just not meant to be. This would be so handy I'm sure for many people as having to check in the Intune Admin centre for waiting approvals is a pain.

It's a great security layer by MS but they really did not think it through, there should be some kind of alerting for this. If you have any ideas or guidance I would gladly appreciate it. Might have to get in touch with MS also.

Was this reply helpful? Yes No