title: Authentication token doesn't have enrollment level access
body: <h2><strong>Background</strong></h2>
  
  <p>I am making a restful API call to Microsoft's Azure Consumption endpoint as detailed below.</p>
  
  <p><a href="https://docs.microsoft.com/en-gb/rest/api/consumption/reservationrecommendations/list" rel="nofollow noreferrer">https://docs.microsoft.com/en-gb/rest/api/consumption/reservationrecommendations/list</a></p>
  
  <p><strong>However I am always presented with the below error.</strong></p>
  
  <blockquote>
    <p>Authentication token doesn't have enrollment level access.</p>
  </blockquote>
  
  <pre><code>{
    "error": {
      "code": "401",
      "message": "Authentication token doesn't have enrollment level access. 
    }
  }
  </code></pre>
  
  <p>The token is valid and can be used to access the other endpoints under the consumption API. The "Try It" test link on the Azure page actually returns a 200, however when I make the call I get a 401.</p>
  
  <h2><strong>Question</strong></h2>
  
  <p>Can anyone shed any light on this error message? I cannot find any help on this error anywhere.</p>
  
  <h2>Code</h2>
  
  <p><strong>Authentication</strong> </p>
  
  <p><a href="https://docs.microsoft.com/en-gb/azure/active-directory/develop/v1-oauth2-client-creds-grant-flow#first-case-access-token-request-with-a-shared-secret" rel="nofollow noreferrer">https://docs.microsoft.com/en-gb/azure/active-directory/develop/v1-oauth2-client-creds-grant-flow#first-case-access-token-request-with-a-shared-secret</a></p>
  
  <pre><code> private static string GetAccessToken(string clientId, string clientSecret, string tenantId)
      {
  
          HttpClient client = new HttpClient();
          client.DefaultRequestHeaders.TryAddWithoutValidation("Content-Type", "application/json;");
  
          string hostname = $"https://login.microsoftonline.com/{tenantId}/oauth2/token";
  
          var content = new FormUrlEncodedContent(new[]
          {
              new KeyValuePair&lt;string, string&gt;("grant_type", "client_credentials"),
              new KeyValuePair&lt;string, string&gt;("client_id", clientId),
              new KeyValuePair&lt;string, string&gt;("client_secret", clientSecret),
              new KeyValuePair&lt;string, string&gt;("resource", "https://management.azure.com/")
          });
  
          HttpResponseMessage httpResponse = client.PostAsync(hostname, content).Result;
          var responseString = httpResponse.Content.ReadAsStringAsync();
  
          if (httpResponse.StatusCode == HttpStatusCode.OK)
          {
              dynamic tokenObject = JsonConvert.DeserializeObject(responseString.Result);
  
              return tokenObject.access_token;
          }
          else
          {
              return null;
          }
      }
  </code></pre>
  
  <p><strong>API Call</strong></p>
  
  <pre><code> public static dynamic GetReservationRecommendations(Params parameters)
   {
     var token = GetAccessToken(parameters.ClientId, parameters.ClientSecret, parameters.TenantId);
  
       HttpClient client = new HttpClient();
       client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("bearer", token);
       client.DefaultRequestHeaders.TryAddWithoutValidation("Content-Type", "application/json;");
  
       string hostname = $"https://management.azure.com/subscriptions/{parameters.SubscriptionId}/providers/Microsoft.Consumption/reservationRecommendations?api-version=2018-10-01";
  
       HttpResponseMessage httpResponse = client.GetAsync(hostname).Result;
       var responseString = httpResponse.Content.ReadAsStringAsync();
  
       if (httpResponse.StatusCode == HttpStatusCode.OK)
       {
           return responseString.Result;
       }
       else
       {
           return null;
       }
   }
  </code></pre>