Bug when using unassign action

[kmenzli]

Hello

I'm testing release R3. I faced a problem.

When I Try to Unassign a Token I get this message :
Failed to unassign token
{ "error": { "code": "accessDenied", "message": "Request Authorization failed", "innerError": { "message": "Request Authorization failed", "date": "2026-08-12T16:15:38", "request-id": "15e1f984-6a39-48f7-96a8-868383591d71", "client-request-id": "15e1f984-6a39-48f7-96a8-868383591d71" } } }

To better understand the difference between available actions , does Unassign allow us to dossiciate the key from the user account (so I can assign it to another user), whereas Delete removes the ley from EntraID.

What is the purpose of the Seen field in the list of displayed tokens?What are the possible values.

Best Regards
K.MENZLI

[token2]

Unassign error: This is a permissions/auth-mode issue, not a bug. The Unassign action calls DELETE /beta/users/{id}/authentication/hardwareOathMethods/{tokenId}. Per Microsoft's docs, that endpoint does not support application permissions - only delegated account with UserAuthenticationMethod.ReadWrite.All and an admin holding the Authentication Administrator role. Since the app authenticates app-only (client credentials and assuming certificates), this call can't succeed regardless of consented permissions. That's why Assign and Delete work but Unassign returns "Request Authorization failed."

Unassign vs Delete: Correct - Unassign dissociates the token from the user but keeps it in the directory so you can reassign it to someone else. Delete removes the token from Entra ID entirely (and a token must be unassigned before it can be deleted).

Seen field: It shows the token's lastUsedDateTime - the timestamp of the last successful sign-in with that token, or Never if it hasn't been used yet.

[kmenzli]

Thank you @token2 for all those explanations.
Is there any way to work around this issue using the utility?
Where can I find Microsoft Documentation about this case?

Thankyou again

[kmenzli]

@token2 any news ?

[token2]

@token2 any news ?

Sorry for not updating, we asked Microsoft - as you can assume, no response yet. As a response to your previous question the reference is:

https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-mfa-manage-oath-tokens

So, I suggest "playing" with permissions to see which one is required to unassign, as the documentation only says "Authentication Policy Administrators " can do it

[kmenzli]

Thank @token2 again for your explanations

I found this link : https://learn.microsoft.com/en-us/graph/api/authentication-delete-hardwareoathmethods?view=graph-rest-beta&tabs=java

Token Tools uses beta version or v1.0? can I switch between Graph Version from the config files?

[token2]

Thank @token2 again for your explanations
Token Tools uses beta version or v1.0? can I switch between Graph Version from the config files?

The app uses v1.0. I just tested the same action again and it works for me, so it is not an API issue. The test was with both client secret and certificate method. Can you verify the permissions once more? Here is our working test example: