Forum Discussion

EPNAdam's avatar
EPNAdam
Iron Contributor
Apr 24, 2025

onBehalfOfUserMri cannot be null or empty - Team installedApps

Hi,

Posting this in the Graph community as I suspect the issue is Graph related since I can reproduce this via PowerShell script as well.

Anyone else with this issue? Reading up on the https://learn.microsoft.com/en-us/graph/api/team-post-installedapps?view=graph-rest-1.0&tabs=http then there is nothing on the "onBehalfOfUserMri"

 

Background:

I have an flow that is via an HTTP Request call installing an App on a Team. This via an Service Principal in Azure using Client Id and Client Secret. Reference to the Graph API call can be found https://learn.microsoft.com/en-us/graph/api/team-post-installedapps?view=graph-rest-1.0&tabs=http.

The flow has been running for years without any issues until yesterday.

 

Error: Graph Error Message: onBehalfOfUserMri cannot be null or empty. (Parameter 'onBehalfOfUserMri')

 

Details:

I have been able to reproduce this issue in PowerShell as well:

Write-Error: Graph Error Message: onBehalfOfUserMri cannot be null or empty. (Parameter 'onBehalfOfUserMri')
Write-Error: Graph Inner Error: {
  "code": "InvalidRequest",
  "message": "onBehalfOfUserMri cannot be null or empty. (Parameter 'onBehalfOfUserMri')",
  "details": [],
  "date": "2025-04-24T15:02:02",
  "request-id": "4b71b933-...-...-...-094bfa5b78f4",
  "client-request-id": "4b71b933-...-...-...-094bfa5b78f4"
}

api
Office Graph

3 Replies

Sort By
  • EPNAdam's avatar
    EPNAdam
    Iron Contributor
    Apr 25, 2025

    Update 2025-04-25: It works today without any changes made.

  • Artur-WM's avatar
    Artur-WM
    Copper Contributor
    Apr 24, 2025

    Hi


    We started getting the same errors today too approximately from 24 April 2025 7AM UTC. (+-1 hour)

    https://learn.microsoft.com/en-us/graph/api/team-post-installedapps?view=graph-rest-1.0&tabs=http endpoint throws errors using Delegated or Application permissions.

     

    When use the Delegated scope TeamsAppInstallation.ReadWriteForTeam the next error is thrown

    { "error": { "code": "Unauthorized", "message": "Failed to execute Skype backend request GetThreadRequest.", "innerError": { "code": "UnauthorizedAccess", "message": "Failed to execute Skype backend request GetThreadRequest.", "details": [], "date": "2025-04-24T20:55:12", "request-id": "4fec60bf-*****-181a1a095af8", "client-request-id": "4fec60bf-*****-181a1a095af8" } } }

     

    When use the Application role TeamsAppInstallation.ReadWriteForTeam.All

    { "error": { "code": "BadRequest", "message": "onBehalfOfUserMri cannot be null or empty. (Parameter 'onBehalfOfUserMri')", "innerError": { "code": "InvalidRequest", "message": "onBehalfOfUserMri cannot be null or empty. (Parameter 'onBehalfOfUserMri')", "details": [], "date": "2025-04-24T20:54:03", "request-id": "e5764205-*****-55f82250024e", "client-request-id": "e5764205-******-55f82250024e" } } }

     

    The most interesting finding that the app is being added to the Team, but if the Teams' app has a Bot, the Bot is not added and when tries to send message behalf of the Bot a Forbidden (BotNotInConversationRoster) error is thrown.

     

    The issue was reproduced on 4 different tenants including dev ones and enterprise with thousands of licensed users.

     

    I have found only one workaround how to temporary mitigate the issue until it will be fixed. This is a combination of usage a Service Account and invoking non-documented Teams internal API endpoint (eg simulate the same request what Microsoft Teams client uses internally).

  • EPNAdam's avatar
    EPNAdam
    Iron Contributor
    Apr 24, 2025

    Some additional details:
    Test code to reproduce the issue I used as follows and the App I'm trying to add is the Dynamics 365 App.
    As mentioned, it has been working for years.

     

    ...
$teamsAppId = "cd2d8695-bdc9-4d8e-9620-cc963ed81f41"  # Dynamics 365 App

$requestBody = @{
        # Note {at sign} shall be @
        "teamsApp{at sign}odata.bind" = "https://graph.microsoft.com/v1.0/appCatalogs/teamsApps/$teamsAppId"
    } | ConvertTo-Json -Compress

$installParams = @{
        Method      = 'Post'
        Uri         = "https://graph.microsoft.com/v1.0/teams/$teamId/installedApps"
        Headers     = @{
            'Authorization' = "Bearer $token"
            'Content-Type' = 'application/json'
        }
        Body        = $requestBody
        ErrorAction = 'Stop'
    }

    $response = Invoke-RestMethod @installParams

    Write-Host "Teams app installed successfully" -ForegroundColor Green

     

Resources