Intune: Unknown "Error during Export:"

[jj4152]

Description of the issue

Hi, i'm trying to export the Intune Workload but get the following Error on ALL resources during export.

Seems like I'm missing some sort of permission but unfortunately I was able to find out anything meaningful while troubleshooting.

Thanks!

Microsoft 365 DSC Version

1.25.806.1

Which workloads are affected

Intune

The DSC configuration

Export-M365DSCConfiguration -Workloads @("Intune") -Credential $credential -ApplicationId $applicationId -Path $folderPath -FileName $exportFileName

Verbose logs showing the problem

===== ONE OF THE ERRORS FROM THE Error-Log-File generated by M365DSC. THERE ARE NO OTHER KIND OF ERRORS =====
[2025.11.07 05:26:48]
{InvalidOperation}
System.Exception: [UnknownError] : {"ErrorCode":"Forbidden","Message":"{\r\n  \"_version\": 3,\r\n  \"Message\": \"An error has occurred - Operation ID (for customer support): 00000000-0000-0000-0000-000000000000 - Activity ID: 64052875-97b5-4fe2-955a-ca4c69a7f28f - Url: https://proxy.msub01.manage.microsoft.com/DeviceConfigV2/DCV2GraphService/de147310-ffff-4141-0607-110508354507/deviceManagement/configurationPolicies?api-version=5025-09-01&$select=createdDateTime%2ccreationSource%2cdescription%2clastModifiedDateTime%2cname%2cplatforms%2cpriorityMetaData%2croleScopeTagIds%2csettingCount%2ctechnologies%2ctemplateReference%2cid\",\r\n  \"CustomApiErrorPhrase\": \"\",\r\n  \"RetryAfter\": null,\r\n  \"ErrorSourceService\": \"\",\r\n  \"HttpHeaders\": \"{\\\"WWW-Authenticate\\\":\\\"Bearer\\\"}\"\r\n}","Target":null,"Details":null,"InnerError":null,"InstanceAnnotations":[]}
"Error during Export:"
at Get-MgBetaDeviceManagementConfigurationPolicy<Process>, C:\Program Files\WindowsPowerShell\Modules\Microsoft.Graph.Beta.DeviceManagement\2.28.0\exports\ProxyCmdletDefinitions.ps1: line 27244
at Export-TargetResource, C:\Program Files\WindowsPowerShell\Modules\Microsoft365DSC\1.25.806.1\DSCResources\MSFT_IntuneAccountProtectionPolicyWindows10\MSFT_IntuneAccountProtectionPolicyWindows10.psm1: line 656
at Start-M365DSCConfigurationExtract, C:\Program Files\WindowsPowerShell\Modules\Microsoft365DSC\1.25.806.1\Modules\M365DSCReverse.psm1: line 680
at Export-M365DSCConfiguration, C:\Program Files\WindowsPowerShell\Modules\Microsoft365DSC\1.25.806.1\Modules\M365DSCUtil.psm1: line 1560
at <ScriptBlock>, C:\Users\username\Documents\m365DSC\IntuneExport.ps1: line 37
`
Line 37 inside IntuneExport.ps1:
`Export-M365DSCConfiguration -Workloads @("Intune") -Credential $credential -ApplicationId $applicationId -Path $folderPath -FileName $exportFileName


===== LOG DURING EXPORT =====
`Exporting Microsoft 365 configuration for Workloads: Intune
Finding all resources for workload {Intune} and Mode {Default}

Authentication methods specified:
- CredentialsWithApplicationId

Connecting to {MicrosoftGraph}...✅
[1/140] Extracting [IntuneAccountProtectionLocalAdministratorPasswordSolutionPolicy] using {CredentialsWithApplicationId}...
    🟡 The current tenant is not registered for Intune.
    🟡 The current tenant is not registered for Intune.
    🟡 The current tenant is not registered for Intune.
[2/140] Extracting [IntuneAccountProtectionLocalUserGroupMembershipPolicy] using {CredentialsWithApplicationId}...[3/140] Extracting [IntuneAccountProtectionPolicy] using {CredentialsWithApplicationId}...[4/140] Extracting [IntuneAccountProtectionPolicyWindows10] using {CredentialsWithApplicationId}...❌
Error Log created at {file://C:/Users/username\Documents\m365DSC/15828-M365DSC-ErrorLog.log}
    🟡 The current tenant is not registered for Intune.
[5/140] Extracting [IntuneAndroidManagedStoreAppConfiguration] using {CredentialsWithApplicationId}...[6/140] Extracting [IntuneAntivirusExclusionsPolicyLinux] using {CredentialsWithApplicationId}...❌
Error Log created at {file://C:/Users/username\Documents\m365DSC/15828-M365DSC-ErrorLog.log}
[7/140] Extracting [IntuneAntivirusExclusionsPolicyMacOS] using {CredentialsWithApplicationId}...❌
Error Log created at {file://C:/Users/username\Documents\m365DSC/15828-M365DSC-ErrorLog.log}
[8/140] Extracting [IntuneAntivirusPolicyLinux] using {CredentialsWithApplicationId}...❌
Error Log created at {file://C:/Users/username\Documents\m365DSC/15828-M365DSC-ErrorLog.log}
[9/140] Extracting [IntuneAntivirusPolicyMacOS] using {CredentialsWithApplicationId}...❌
..

Environment Information + PowerShell Version

OsName               : Microsoft Windows Server 2022 Datacenter
OsOperatingSystemSKU : DatacenterServerEdition
OsArchitecture       : 64-bit
WindowsVersion       : 2009
WindowsBuildLabEx    : 20348.1.amd64fre.fe_release.210507-1500
OsLanguage           : en-US
OsMuiLanguages       : {en-US}


Name                           Value
----                           -----
PSVersion                      5.1.20348.4294
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.20348.4294
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

[FabienTschanz]

There is currently an issue with credential authentication. Please try ApplicationId with CertificateThumbprint oder ClientSecret as a temporary workaround until the next version is released.

[jj4152]

Hey Fabian, thank you so much for the info! Is this only for the Intune workload? Because I was able to successfully authenticate and export the Entra configuration (which also uses Microsoft Graph) using this version and credential authentication.

So I think this might not be the issue here.

[FabienTschanz]

@jj4152 Can you please try again with the latest release 1.25.1112.1? It contains a couple of fixes for the authentication, also what I was talking about with Credentials.

Can you please share the permissions you assigned to the service principal? For Credential authentication, they should be delegated I think. You can get all of the permissions using the Get-M365DSCCompiledPermissionList cmdlet.