Skip to content

Clear-MgSecurityCaseEdiscoveryCaseSearchData returning "Token is not a Bearer token" error #3042

@aaronmi

Description

@aaronmi

Describe the bug

Invalid token is generated for USGov environment.

Expected behavior

Performing the operation "Clear-MgSecurityCaseEdiscoveryCaseSearchData_PurgeExpanded" without error.

How to reproduce

  1. Execute "Connect-MgGraph -Scopes "ediscovery.ReadWrite.All" -Environment USGov" and sign in with a user who is a ediscovery case admin.
  2. Execute "Clear-MgSecurityCaseEdiscoveryCaseSearchData -EdiscoveryCaseId "95b08e2e-xxxx-4808-9128-757f2bd38565" -EdiscoverySearchId "b90a7dd8-7935-xxxx-a86a-8603206b82cb"

SDK Version

2.24.0

Latest version known to work for scenario above?

2.24.0

Known Workarounds

No response

Debug output

Click to expand log ```

PS >Connect-MgGraph -Scopes "ediscovery.ReadWrite.All" -Environment USGov
Welcome to Microsoft Graph!

PS > Clear-MgSecurityCaseEdiscoveryCaseSearchData -EdiscoveryCaseId "95b08e2e-xxxx-4808-9128-757f2bd38565" -EdiscoverySearchId "b90a7dd8-7935-xxxx-a86a-8603206b82cb" -Debug

DEBUG: [CmdletBeginProcessing]: - Clear-MgSecurityCaseEdiscoveryCaseSearchData begin processing with parameterSet
'PurgeExpanded'.

Confirm
Continue with this operation?
[Y] Yes [A] Yes to All [H] Halt Command [S] Suspend [?] Help (default is "Y"): a

DEBUG: [Authentication]: - AuthType: 'Delegated', TokenCredentialType: 'InteractiveBrowser', ContextScope:
'CurrentUser', AppName: 'Microsoft Graph PowerShell'.
DEBUG: [Authentication]: - Scopes: [Application.Read.All, Application.ReadWrite.All, AppRoleAssignment.ReadWrite.All,
AuditLog.Read.All, Chat.ReadBasic, Chat.ReadWrite, DeviceManagementConfiguration.Read.All,
DeviceManagementManagedDevices.PrivilegedOperations.All, DeviceManagementManagedDevices.Read.All,
DeviceManagementManagedDevices.ReadWrite.All, Directory.Read.All, Directory.ReadWrite.All, eDiscovery.ReadWrite.All,
Group.Read.All, Group.ReadWrite.All, GroupMember.Read.All, GroupMember.ReadWrite.All, Mail.ReadWrite, openid,
People.Read, Policy.Read.All, Presence.Read.All, profile, Reports.Read.All, ReportSettings.ReadWrite.All,
RoleManagement.ReadWrite.Directory, Sites.Manage.All, Tasks.ReadWrite, User.Read, User.Read.All, User.ReadWrite.All,
email].

Confirm
Are you sure you want to perform this action?
Performing the operation "Clear-MgSecurityCaseEdiscoveryCaseSearchData_PurgeExpanded" on target "Call remote 'POST
/security/cases/ediscoveryCases/{ediscoveryCase-id}/searches/{ediscoverySearch-id}/microsoft.graph.security.purgeData'
operation".

[Y] Yes [A] Yes to All [N] No [L] No to All [S] Suspend [?] Help (default is "Y"): a
DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:

POST

Absolute Uri:
https://graph.microsoft.us/v1.0/security/cases/ediscoveryCases/95b08e2e-xxxx-4808-9128-757f2bd38565/searches/b90a7dd8-7935-xxxx-a86a-8603206b82cb/microsoft.graph.security.purgeData

Headers:
FeatureFlag : 00000043
Cache-Control : no-store, no-cache

User-Agent : Mozilla/5.0,(Windows NT 10.0; Microsoft Windows 10.0.17763;
en-US),PowerShell/5.1.17763.6530

Accept-Encoding : gzip

SdkVersion : graph-powershell/2.24.0

client-request-id : ea45ce45-ca9b-4c77-9d05-7617f8af9394

Body:
{}

DEBUG: ============================ HTTP RESPONSE ============================

Status Code:Unauthorized

Headers:
Transfer-Encoding : chunked
Vary : Accept-Encoding
Strict-Transport-Security : max-age=31536000
request-id : d3a662b0-9b84-422c-b8f5-e706eb3df63d
client-request-id : 6741a0f9-9811-4604-89ce-931e5bbae444
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"USGov
Texas","Slice":"E","Ring":"4","ScaleUnit":"000","RoleInstance":"SN5NEPFxxxx1Fxx"}}
Cache-Control : no-store, must-revalidate, no-cache, max-age=0
Date : Thu, 28 Nov 2024 01:34:48 GMT

Body:
{
"error": {
"code": "Unauthorized",
"message": "Token is not a Bearer token",
"innerError": {
"date": "2024-11-28T01:34:49",
"request-id": "d3a662b0-9b84-422c-b8f5-e706eb3df63d",
"client-request-id": "6741a0f9-9811-4604-89ce-931e5bbae444"
}
}
}

Confirm
Token is not a Bearer token

Status: 401 (Unauthorized)
ErrorCode: Unauthorized
Date: 2024-11-28T01:34:49

Headers:
Transfer-Encoding : chunked
Vary : Accept-Encoding
Strict-Transport-Security : max-age=31536000
request-id : d3a662b0-9b84-422c-b8f5-e706eb3df63d
client-request-id : 6741a0f9-9811-4604-89ce-931e5bbae444
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"USGov
Texas","Slice":"E","Ring":"4","ScaleUnit":"000","RoleInstance":"SN5NEPFxxxx1Fxx"}}
Cache-Control : no-store, must-revalidate, no-cache, max-age=0
Date : Thu, 28 Nov 2024 01:34:48 GMT

[Y] Yes [A] Yes to All [H] Halt Command [S] Suspend [?] Help (default is "Y"): a
Clear-MgSecurityCaseEdiscoveryCaseSearchData : Token is not a Bearer token

Status: 401 (Unauthorized)
ErrorCode: Unauthorized
Date: 2024-11-28T01:34:49

Headers:
Transfer-Encoding : chunked
Vary : Accept-Encoding
Strict-Transport-Security : max-age=31536000
request-id : d3a662b0-9b84-422c-b8f5-e706eb3df63d
client-request-id : 6741a0f9-9811-4604-89ce-931e5bbae444
x-ms-ags-diagnostic : {"ServerInfo":{"DataCenter":"USGov
Texas","Slice":"E","Ring":"4","ScaleUnit":"000","RoleInstance":"SN5NEPFxxxx1Fxx"}}
Cache-Control : no-store, must-revalidate, no-cache, max-age=0
Date : Thu, 28 Nov 2024 01:34:48 GMT

At line:1 char:1
Clear-MgSecurityCaseEdiscoveryCaseSearchData -EdiscoveryCaseId "95b08 ...
...
CategoryInfo : InvalidOperation: ({ EdiscoveryCas...ionJsonSchema }:<>f__AnonymousType7`4) [Clear-MgSec
urit...a_PurgeExpanded], Exception
FullyQualifiedErrorId : Unauthorized,Microsoft.Graph.PowerShell.Cmdlets.ClearMgSecurityCaseEdiscoveryCaseSearchD
ata_PurgeExpanded
DEBUG: [CmdletEndProcessing]: - Clear-MgSecurityCaseEdiscoveryCaseSearchData end processing.

</details>


### Configuration

_No response_

### Other information

_No response_

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions