I’m hitting the exact same error. I’ve tried consenting with different accounts, manipulate conditional access policies and random other tweaks but no luck.
Can you guys tell me if you have SkipRegistryTest or ClearExistingEnrollments set to true, or CacheProvisioningPackage set to false? Directory migration was returing this error up until recently until we realized that these 3 parameters were hardcoded into the script with these values. The issue is probably with one, or a combination, of these parameters. Microsoft is making numerous changes on their side, and I don’t think they behaved this way until quite recently.
Also, just for clarity, are you using the Oauth2 flow or the Username/Password flow to join devices?
@Darren_Rose , I saw you have a ticket in already. Can you send one in as well @HonourJ if you haven’t already, so we can track it?
Everything is left default for SkipRegistryTest, ClearExistingEnrollments and CacheProvisioningPackage. Do you want me to change these to something specific and run another test?
I am using Oauth2flow but have tried the username/password and I get a tenant ID issue as it defaults to the Tenant ID in Immybot (in this case 40) opposed to the actual clients tenant ID.
AADSTS90093 GraphUserUnauthorized - Graph returned with a forbidden error code for the request.
That is what the error message is indicating.
I would check Conditional Access Policies,
Make sure your enrollment user has Device Administrator role
Don’t use the enforce intune enrollment option, just make sure your setup of Auto-enrollment into inTune.
If your using custom app, make sure your have correct permissions assigned and have approved that in the tenant app.
If your using the built in app, make sure its approved in the tenant as well.
I just had this error pop up during a M365 Tenant to Tenant profile migration.
I found that the device I was trying to migrate had an AutoPilot registration in the source tenant.
Manual join also failed due to AutoPilot.
Once I flushed that out,
and manually flushed out enrollments (even though I had it checked to flush)
I was able to complete Entra Join process into the Destination tenant manually; I am still getting the same error via Immy join; Though I’ll test some more tomorrow, just wanted to pass some findings along.