Troubleshooting

Troubleshooting

Base Module - Bad Request

The base module returns a Bad Request to the logic app with the following error message The API call to msgraph with path /v1.0/organization failed with status 403.

This indicates that the function app executed by did not have sufficient permissions to access the Microsoft Graph. This is usually caused by one of the following issues:

1. The GrantPermissions.ps1 script either was not run successfully or not run against the correct identity. Ensure the script is run correctly
2. The function app has a cached token from prior to the GrnatPermissions.ps1 scripts execution, restart the function app to clear the cache
3. A delay in processing the permissions in the backend, wait 1-2 hours and try again

Base Module - Unauthorized

The base module returns an Unauthorized error to the logic app with a content length of 0, such as:

{
    "statusCode": 401,
    "headers": {
        "Date": "Thu, 07 Nov 2024 18:45:04 GMT",
        "Content-Length": "0"
    }
}

This indicates the the function app could not be invoked which is usually due to either:

1. The incorrect function app key is used in the API connection. See this FAQ on obtaining the correct function code.
2. There is a configuration error in the function app itself, such as an issue in one of the environment variables, a network configuration is blocking access to function app or other issue. Please review any configuration changes you have made since deployment.

Why cannot I see the STAT custom connector in the logic app designer?

The connector is only visible for logic apps created in the same region as the connector.

Why is the Defender for Cloud Apps module failing?

Microsoft has announced the retirement of the investigation priority score which this module is based on. The retirement was announced in Message Center MC889532. As this module is based on this score, it's absence will cause the module to fail with an error such as:

{
    "Error": "Module processing failed, an unknown exception has occurred.",
    "InvocationId": "170d5892-08cd-4c18-9e2b-5aaf263fa877",
    "Traceback": [
        "Traceback (most recent call last):\n",
        "  File \"/home/site/wwwroot/modules/__init__.py\", line 19, in main\n    return_data = coordinator.initiate_module(module_name=module_name, req_body=req_body)\n",
        "  File \"/home/site/wwwroot/shared/coordinator.py\", line 21, in initiate_module\n    return_data = mdca.execute_mdca_module(req_body)\n",
        "  File \"/home/site/wwwroot/modules/mdca.py\", line 50, in execute_mdca_module\n    current_account['ThreatScore'] = 0 if mdcaresults['threatScore'] is None else mdcaresults['threatScore']\n",
        "KeyError: 'threatScore'\n"
    ]
}

Subsequent releases of STAT will address this failure, likely by retiring the module. This work is being tracked under https://github.com/briandelmsft/STAT-Function/issues/106.

In the interim it is recommended to stop use of this module, including removing it from the risk scoring calculation.