[!] HTTP 400 Error: Most likely due to missing Entra ID premium licence. Assuming no PIM for Azure is used.

[albert-widjaja]

Hi Team,

I receive this error message when executing the Entra Falcon using the Read Only account as suggested.

[!] HTTP 400 Error: Most likely due to missing Entra ID premium licence. Assuming no PIM for Azure is used.
My tenant already has an Entra ID Premium P2 license, but not sure why it shows like the above?

[zh54321]

Hi, thank you very much for reporting this issue.

In general, this message is displayed when the request to:
https://management.azure.com/subscriptions/$($subscription.Id)/providers/Microsoft.Authorization/roleEligibilitySchedules?api-version=2020-10-01-preview returns an HTTP 400 response.

I assume you have access to multiple Azure subscriptions, correct?
Right before the error, the script should print how many subscriptions were detected, for example:

[+] User has access to 2 Subscription(s).
[*] Get Azure IAM assignments
[!] HTTP 400 Error: Most likely due to missing Entra ID premium licence. Assuming no PIM for Azure is used. Response status code does not indicate success: 400 (Bad Request).

Could you please confirm:

• Is this error message displayed only once, or multiple times?
  • If it is shown only once, this would indicate that only a specific subscription is affected.
  • Do you know if there is a subscription is managed by a partner, or if you have access to a subscription from another tenant (for example via Azure Lighthouse / Partner Center)?

Thanks again for the report!

[zh54321]

I just released a new version that improves the troubleshooting output for this case. If you run the script with debug logging enabled (-LogLevel Debug), it should show exactly which subscription triggers the HTTP 400 response for the PIM role eligibility schedule request.

Example:
.\EntraFalcon.ps1 -LogLevel Debug

Could you please confirm:

• Is this error message displayed only once, or multiple times?
• Do you know if the affected subscription(s) are managed by a partner, or if you have access to a subscription from another tenant (for example via Azure Lighthouse / Partner Center)?