MIP SDK Getting Access Denied error while invoking profile AddEngineAsync

Question

Im trying to set label using MIP SDK. However while executing AddEngineAsync, I am getting access denied error. I am able to get access token from AAD APP. Any help would be great.

Code:

var engine = Task.Run(async () => await profile.AddEngineAsync(engineSettings)).Result;

Error:

Unhandled Exception: System.AggregateException: One or more errors occurred. ---> Microsoft.InformationProtection.Exceptions.AccessDeniedException: The service didn't accept the auth token. Challenge:['']
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at MipSdkDotNetQuickstart.Action.<>c__DisplayClass10_0.<<CreateFileEngine>b__0>d.MoveNext() in C:\Users\wb561362\Mip_ServicePrincipalAuth\mip-sdk-dotnet-file-SPA\Action.cs:line 178
   --- End of inner exception stack trace ---
   at System.Threading.Tasks.Task`1.GetResultCore(Boolean waitCompletionNotification)
   at MipSdkDotNetQuickstart.Action.CreateFileEngine(Identity identity) in C:\Users\wb561362\Mip_ServicePrincipalAuth\mip-sdk-dotnet-file-SPA\Action.cs:line 178
   at MipSdkDotNetQuickstart.Action..ctor(ApplicationInfo appInfo) in C:\Users\wb561362\Mip_ServicePrincipalAuth\mip-sdk-dotnet-file-SPA\Action.cs:line 113
   at MipSdkDotNetQuickstart.Program.Main(String[] args)

Following is the access we have

Tom Moser · Accepted Answer · 2020-10-23 18:22:57Z

1

You should validate you're getting a token for the correct resource. Typically, we see this error when people have hard coded or improperly handled the auth challenge in their auth delegate implementation.

Be sure that you're not hard coding the resource and that you're passing the resource provided as a parameter to AcquireToken() to your MSAL or ADAL implementation.

answered Oct 23, 2020 at 18:22

Tom Moser

7963 silver badges6 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Srini K Over a year ago

Thanks Tom I am not hard coding resource. May I know what are the base permissions required to read labels using MIP SDK? I'm not tenant admin or having any edit access on azure.

Tom Moser Over a year ago

The API permissions are described here. You must have an application registered that has UnifiedPolicy.User.Read. learn.microsoft.com/en-us/information-protection/develop/…

Srini K Over a year ago

Thanks Tom, it was native client redirect URI not configured correctly. Works now.

W.Azhar Over a year ago

Thanks Tom. 'UnifiedPolicy.User.Read' is required if you are using delegated permissions. 'UnifiedPolicy.Tenant.Read' permission worked for me because I was using application permissions.

Collectives™ on Stack Overflow

MIP SDK Getting Access Denied error while invoking profile AddEngineAsync

1 Answer 1

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related