azurepowershellmicrosoft-graph-apiazure-powershellmicrosoft-partner-center

How to fix error 403 Forbidden when accessing partner center API to retrieve customers and users


Am currently battling error 403 forbidden in my partner center API requests and am unable to know what i might be missing or doing wrong.

I have followed Microsoft documentation but still same issue.

My End Goal

To be able to retrieve customers and view users in customer tenants that i manage and export the results into a csv file(same information visible in partner center under customer workspace) using partner center APIs. I'm using PowerShell to achieve this. Below is the endpoint URLs that is documented to call.

GET https://api.partnercenter.microsoft.com/v{version}/customers to list customers from partner center

GET https://api.partnercenter.microsoft.com/v1/customers/<customer-tenant-id> to list users in customer tenant from partner center

What i have done in my environment.

  1. My partner center type is CSP, indirect provider - cloud reseller.

  2. My account in partner center has Global admin, admin agents, sales agent roles(infact all available roles assigned)

  3. I created an app registration of type Accounts in this organizational directory only (myorgname - Single tenant) and Redirect URI set to web

  4. The app registration is assigned three delegated permission enter image description here

  5. I associated the app registration i created above inside partner center and assigned it Owner plus manager role ms doc

  6. Am able to successfully authenticate to my partner center API thanks to support here, that is i can successfully get a refresh token, connect to partner center using the refresh token and even use the refresh token to generate a new access token(valid 90 days), which i can use as Bearer for REST API call

  7. I can view my customers from the customers workspace in partner center using GUI.

Issue

When i run an API request to either of this endpoints GET https://api.partnercenter.microsoft.com/v1/customers or GET https://api.partnercenter.microsoft.com/v1/customers/<customer-tenant-id>, either using REST API flow or PowerShell SDK i get 403 forbidden.

$mynewtoken = "new token requested using refresh token"
$url = "https://api.partnercenter.microsoft.com/v1/customers"
$headers = @{
    "Authorization" = "Bearer $mynewtoken"
    "Accept"        = "application/json"

}

$response = Invoke-RestMethod -Method Get -Uri $url -Headers $headers
$response

or

$customers = Get-PartnerCustomer
$customers | ForEach-Object {
    Write-Output "Customer ID: $($_.CustomerId), Company Name: $($_.CompanyProfile.CompanyName)"
}

enter image description here


Solution

  • Posting the answer to help community, to resolve the error execute the PowerShell script as a normal user and set the execution policy as unrestricted:

    Set-ExecutionPolicy Unrestricted -Scope CurrentUser
    

    enter image description here

    I am able to execute the script successfully:

    $appId = "AppID"
    $appSecret = ConvertTo-SecureString -String "Secret" -AsPlainText -Force
    $tenantId = "TenantID" 
    $credential = [PSCredential]::new($appId, $appSecret)
    
    $tokenSplat = @{
        ApplicationId        = $appId
        Credential           = $credential
        Scopes               = "https://api.partnercenter.microsoft.com/user_impersonation"
        ServicePrincipal     = $true
        TenantId             = $tenantId
        UseAuthorizationCode = $true
    }
    
    $token = New-PartnerAccessToken @tokenSplat
    
    $token.RefreshToken
    
    $connectSplat = @{
        ApplicationId = $appId
        Credential    = $credential
        RefreshToken  = $token.RefreshToken
    }
    
    Connect-PartnerCenter @connectSplat
    
    Get-PartnerRole
    

    enter image description here