Repository navigation
Remove-MgBetaDeviceManagementDomainJoinConnector returns 403 #3685
Description
Describe the bug
Attempting to remove an old connector as Global Admin and Scope "DeviceManagementConfiguration.ReadWrite.All". Invoking Remove-MgBetaDeviceManagementDomainJoinConnector returns the following:
Status: 403 (Forbidden)
ErrorCode: UnknownError
Date: 2026-07-31T19:24:09
Expected behavior
It should delete the connector without error.
How to reproduce
Install-Module -Name "Microsoft.Graph.Beta.DeviceManagement.Administration" -Scope CurrentUser -Repository PSGallery
Connect-MgGraph -Scopes DeviceManagementConfiguration.ReadWrite.All
Remove-MgBetaDeviceManagementDomainJoinConnector -DeviceManagementDomainJoinConnectorId "fc4a3994-9d48-4be9-91a5-02f7cf1c1a62"SDK Version
2.38.1
Latest version known to work for scenario above?
No response
Known Workarounds
No response
Debug output
No response
Configuration
PSVersion 7.6.3
PSEdition Core
GitCommitId 7.6.3
OS Microsoft Windows 10.0.26100
Platform Win32NT
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.4
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
Other information
No response
Activity
tylermontneyacc commentedon Jul 31, 2026
I thought maybe it being in an "Active" state was the problem. It finally went back to "Error" state, and I still can't delete it.
ramsessanchez commentedon Aug 5, 2026
Hi Tyler (@tylermontneyacc) , the 403 error code implies a permissions issue. Can you confirm that the account you are using has the required permissions to run this command? Further, I recommend trying this request in Graph Explorer to confirm if this is a permissions issue or a sdk issue.
tylermontneyacc commentedon Aug 5, 2026
Graph Explorer produces the same result as GA. I've consented
DeviceManagementConfiguration.ReadWrite.All. Can read but not delete.tylermontneyacc commentedon Aug 5, 2026
According to my MS support case, this is by design. I half expected it, as other connectors they have can't be deleted. But to have a Graph doc on it seems very misleading. Graph calls the ODJ service (same service the connector calls), so I don't believe this would work for anyone.
Unless y'all have some cool Microsoft contacts on that side, I think this cmdlet should either be removed or return a descriptive error.