No active license found - Defender 365

Question

When trying to access the Microsoft 365 Defender list incident API. I have added the required application permission to generate the bearer token. When i hit the incident endpoint i was able to see below issue.

Endpoint - https://api.security.microsoft.com/api/incidents

Response :

{
    "error": {
        "code": "Unauthorized",
        "message": "Unauthorized request - No active license found",
        "target": "|208630d1-426cdcef8f366a8e."
    }
}

Answer

@Chethan

Thank you for posting your query on Microsoft Q&A, from above description I was able conclude that you are looking for a way to call the security API to get the incidents and alerts https://api.security.microsoft.com/api/incidents.

Seems like there is a documentation update in progress as new graph API has been listed in the doc. You may try using List incidents V1.0,

You need following permissions for incidents API and call

GET https://graph.microsoft.com/v1.0/security/incidents with Bearer {token} in Auth request:

User's image

I tried same from graph and was able to run the query, got a null value as I don't have any incidents to be reported.

User's image

Please do let me know if you have any queries by responding in the comments section.

Thanks,

Akshay Kaushik

Please "Accept the answer" (Yes), and share your feedback if the suggestion answers you’re your query. This will help us and others in the community as well.

Share via

No active license found - Defender 365

1 answer