'Unauthorized' error when requesting '/joinedTeams' from Microsoft Graph

Question

Also on SO: https://stackoverflow.com/questions/62555955/unauthorized-error-when-requesting-joinedteams-from-microsoft-graph

I am setting up an app for modifying a Microsoft Teams account (teams/channels) through the Microsoft Graph API, but I can't get responses from all of the endpoints which I need to call. I have followed the guide for creating an app with application permissions and acquired access (and refresh) token(s) succesfully.

Calling the https://graph.microsoft.com/v1.0/users/<user guid>/joinedTeams endpoint yields a response as follows:

{  
  "error": {  
    "code": "Unauthorized",  
    "message": "Unauthorized",  
    "innerError": {  
      "date": "2020-06-24T12:37:53",  
      "request-id": <guid>  
    }  
  }  
}  

while calling endpoints such as https://graph.microsoft.com/v1.0/users works as described. It would seem that the app hasn't gotten consent and/or permissions to access these, but after signup they are listed on the API permissions in the azure portal enterprise applications page, and the access token JWT contains the specified permissions as a roles object.

From the JWT:

"roles": [  
    "TeamSettings.ReadWrite.All",  
    "User.ReadWrite.All",  
    "Directory.ReadWrite.All",  
    "Group.ReadWrite.All",  
    "TeamMember.ReadWrite.All",  
    "Team.ReadBasic.All",  
    "GroupMember.ReadWrite.All",  
    "Member.Read.Hidden"  
  ]  

I have tried with the Directory.ReadWrite.All permission and also with the full permission list listed on the permissions page for the /joinedTeams endpoint and they all elicit the same error.

Curiously, according to this a 401 - Unauthorized response would be given for expired (or similarly invalid) tokens, however that seems to clearly not be the case as I can call other endpoints with that very token.

What am I missing?

Answer 1

Hi MikkelGaub-8522,

Thanks for visiting our forum. Our forum focuses on Microsoft Teams, which is the hub for team collaboration in Office 365.

Based on your description, it is more related to Azure. It recommends you post this case with Azure tag. You will get the most qualified pool of respondents, and other partners who read the forums regularly can either share their knowledge or learn from your interaction.

Thanks for your understanding.