Get-IntuneBrand Forbidden Error

[AnthonyKersten]

Get-IntuneBrand : Request to https://graph.microsoft.com/Beta/deviceManagement/intuneBrandingProfiles failed with HTTP Status Unauthorized Unauthorized At line:1 char:1

• Get-IntuneBrand

•   + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Get-IntuneBrand
  
  
  

Permissions are as followed:

• Application Permissions

  "roles": [ "Policy.Read.ConditionalAccess", "DeviceManagementManagedDevices.Read.All", "Device.Read.All", "Group.Read.All", "DeviceManagementServiceConfig.Read.All", "GroupMember.Read.All", "DeviceManagementRBAC.Read.All", "DeviceManagementConfiguration.Read.All", "Policy.Read.All", "DeviceManagementApps.ReadWrite.All", "DeviceManagementApps.Read.All" ],

Permissions are set as per documentation of: https://docs.microsoft.com/en-us/graph/api/intune-wip-intunebrandingprofile-get?view=graph-rest-beta

There is currently 1 users with EMS E3 and Business Premium license.

Using the Graph Explorer (with same app permissions) does work