title: Identity Governance with Microsoft Graph results in 403 Unknown Error (PIM)
body: <p>There is a feature in Azure which is called Identity Governance or Entitlement Management. This feature allows to create access packages and manage user permissions with a request-approve workflow. </p>
  
  <p>I want to automate the creation of the AccessPackages and AccessPackageCatalog Resources. Azure CLI and the Azure PWSH Module do not support the AccessPackages. The only way to automate this is described here: <a href="https://github.com/MicrosoftDocs/azure-docs/issues/52179" rel="nofollow noreferrer">https://github.com/MicrosoftDocs/azure-docs/issues/52179</a> which states: "Use the Microsoft Graph beta API"</p>
  
  <p>I tried the following to access the API from the commandline:</p>
  
  <p>Using plain powershell:</p>
  
  <pre class="lang-bsh prettyprint-override"><code>      $tokenJson=$(az account get-access-token --resource-type ms-graph)
        $tokenObject=$(echo $tokenJson | ConvertFrom-Json)
        $headers = @{Authorization = "Bearer $($tokenObject.accessToken)"}
        $result = Invoke-WebRequest https://graph.microsoft.com/beta/identityGovernance/entitlementManagement/accessPackages -Headers $headers
  </code></pre>
  
  <p>or using <code>az rest</code> </p>
  
  <pre class="lang-sh prettyprint-override"><code>az rest --method get --uri https://graph.microsoft.com/beta/identityGovernance/entitlementManagement/accessPackages
  </code></pre>
  
  <p>both request result in the following error with a 403 response:</p>
  
  <pre><code>{
    "error": {
      "code": "UnknownError",
      "message": "",
      "innerError": {
        "request-id": "0cd50759-d95a-4171-a942-3424cb19a622",
        "date": "2020-05-26T15:34:48"
      }
    }
  }
  </code></pre>
  
  <p>When I try to view the AccessPackages inside the Portal everything works as expected: I can list and create the Packages.</p>
  
  <p><strong>SIDE NOTE</strong> I do NOT have permanent access to the Identity Governance pane in azure. Instead I must use <code>Privileged Identity Management</code> to Activate the <code>User Administrator</code> Role for my Account. </p>
  
  <p><code>az logout &amp;&amp; az login</code> after Role activiation did not change anything.</p>