401 Unauthorized when requesting Graph API /me/messages

Question

I am facing an error whenever i send a GET request to the Graph API to the endpoints /me/contacts or /me/messages. It gives me the following response error:

GET https://graph.microsoft.com/v1.0/me/messages net::ERR_ABORTED 401 (Unauthorized)

I am using the MSAL sample react app that is supposed to correctly get the access token and send a request using the microsoft-graph-client library. When i try to do the GET request using the same account in Microsoft Graph Explorer it works.

It seems like the error comes from the Access Token, because when i copied the Access Token generated in the Microsoft Graph Explorer site using the same request endpoint and account into the code it worked. However, i could not figure why the token generated in the program is not valid.

I made sure that the scopes for the Access Token is exactly the same as the one generated in the Microsoft Graph Explorer site, and that the token is not expired.

Here is the MSAL sample react app:

https://github.com/Azure-Samples/ms-identity-javascript-react-tutorial/tree/main/2-Authorization-I/1-call-graph/SPA

When you run the app and go to the contacts page, it should make a get request to https://graph.microsoft.com/v1.0/me/contacts and retrieve the contacts, however for me it gives the above error.

I should mention that when i try the endpoint https://graph.microsoft.com/v1.0/me in the profile page, it works.

Answer 1

Hi TheRealLambda,

Thanks for reaching out on Microsoft Q&A!

Seems like there is a misconfiguration in the enterpise application providing the authorization flow leading to the token. Please follow the steps in the article below again to check if a part of the configuration is missing:

https://github.com/Azure-Samples/ms-identity-javascript-react-tutorial/blob/main/2-Authorization-I/1-call-graph/README.md#register-the-spa-app-ms-identity-react-c2s1

One other thing that could be the issue is that you may’ve accidentally selected ‘application permissions’ where ‘delegated permissions’ should’ve been selected. Also check if admin consent is granted (states by the green checkmarks behind the API permissions).

Please click ‘Accept answer’ if you think my answer is helpful. Feel free to drop additional queries in the comments below!

Kind regards,

Sonny