Unable to download investigation package from MDE.

Josh Madakor 30 Reputation points
2026-08-12T01:02:08.8566667+00:00

I'm trying to download an investigation package in Defender for Endpoint and the network response is failing with a 403 and showing this:

<?xml version="1.0" encoding="utf-8"?> <Error> <Code>AuthorizationFailure</Code> <Message>This request is not authorized by network security perimeter to perform this operation. RequestId:[PII removed] Time:2026-08-11T17:26:31.6798316Z</Message> </Error>

For more context, here is the request from my browser:

———

Request URL [PII removed] Request Method GET Status Code 403 This request is not authorized by network security perimeter to perform this operation. Remote Address 20.209.179.65:443 Referrer Policy strict-origin-when-cross-origin

———

Microsoft 365 and Office | Microsoft 365 Defender | Other | Windows
0 comments

2 answers

Sort by: Newest
Most helpful Newest Oldest
  1. Kai-H 26,135 Reputation points Microsoft External Staff Moderator
    2026-08-12T07:52:37.7266667+00:00

    (Please note that our forum is a public platform, and we will modify your question to hide your personal information in the description. Kindly ensure that you hide any personal or organizational information the next time you post an error or other details to protect personal data.)

    Hi, Josh Madakor

    The XML message specifically identifies an Azure Storage Network Security Perimeter block, rather than a normal Defender permission or expired-link error. In enforced mode, the perimeter overrides standard storage firewall settings and rejects traffic that is not explicitly allowed.

    Besides the solutions provided by the Q&A Assist, here are some suggestions you can try:

    Try the download from a different Internet connection, such as a mobile hotspot, using an InPrivate window. This helps confirm whether your corporate proxy, VPN, secure web gateway, or SSL inspection is affecting the request.

    Ask your network team to review the failed hostname in the browser’s Network tab and allow outbound HTTPS access to the exact storage domain. Also exclude Defender service traffic from HTTPS inspection. Defender connectivity guidance recommends bypassing SSL/TLS inspection for its service URLs.

    If the same 403 occurs from an unrestricted network, this is likely a Microsoft-side storage perimeter configuration issue. Open a Microsoft support case from the Microsoft 365 admin center and include:

    The full 403 XML response

    Request ID

    UTC timestamp

    The failed blob hostname and a HAR file

    Support will need those details to trace which storage perimeter rule rejected the package request.

    Please be advised that this is a user-to-user support forum. Moderators and contributors, including external Microsoft employees, are not allowed to directly interfere with Microsoft product features or access back-end systems. Our role is limited solely to providing technical guidance on reported incidents, requests, or ideas.   

    Thank you for your patience in reading, I hope this information has been helpful to you. 

    If the answer is helpful, please click "Yes" and kindly upvote it. If you have extra questions about this answer, please click "Comment."    

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread. 

    Was this answer helpful?

  2. AI answer

    2026-08-12T01:02:27.4533333+00:00

    A 403 at the blob download step means the package download URL was issued, but the download request is being blocked before the package can be retrieved. For Defender for Endpoint investigation packages, the download link is short-lived and should be used immediately. If the collection action exists but is not complete, the API returns 404 instead, so a 403 at download time points to access being denied on the package URL rather than the collection still running.

    Use this validation path:

    1. In Microsoft Defender portal, open the device page and go to Action center from the response actions section.
    2. Confirm the action shows Package collection package available.
    3. Download it immediately after it becomes available.
    4. If collecting from the portal again, use Collect investigation package on the device page, add comments, select Confirm, then return to Action center and download from there.
    5. If using API-based retrieval, first collect the package with:
      • POST /api/machines/{id}/collectInvestigationPackage
      • include the required Comment field
    6. After the machine action completes, request the package URI with:
      • GET /api/machineactions/{machine action id}/getPackageUri
      • use the returned link immediately, because it is valid for only a short time.

    Checks that are supported for this scenario:

    • The account must have at least the Alerts Investigation role permission.
    • The account must have access to the device based on device group settings.
    • For API use, the required permission is Machine.CollectForensics for delegated access, or the documented application permission for the API being called.
    • If another collection is already running, starting a new collection returns 400 Bad Request.
    • Package collection can fail on the device if the target device has a low battery level or is on a metered connection.

    If the package is available in Action center but the blob download still returns 403, regenerate the package download path by starting a fresh collection or by requesting a fresh package URI after the machine action completes, then download it immediately.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.