403 Error: Application access policy not found, -Global scope not available in tenant
Hi everyone, I'm trying to use Microsoft Graph API to retrieve online meeting details using an application identity. However, I receive a 403 error with the message: "No application access policy found for this app" I followed the documentation here: Configure application access policy, but I encountered a problem: the -Global scope mentioned in the documentation is not available in my tenant. I’ve successfully granted the policy using the following methods: Option A – Grant to Specific User Grant-CsApplicationAccessPolicy -PolicyName "YOUR_POLICY_NAME" -Identity "email address removed for privacy reasons" Option B – Grant to AD Group New-CsGroupPolicyAssignment -GroupId "YOUR_GROUP_ID" -PolicyType ApplicationAccessPolicy -PolicyName "YOUR_POLICY_NAME" These work fine, and the app can access online meetings for users or groups assigned this way. However, I need to allow the app to access meetings across the organization, and the -Global assignment method is not available in my tenant. Questions: Is there an alternative to -Global for tenant-wide access? Is this limitation expected in certain tenant configurations? Any workaround or best practice for enabling organization-wide access to online meetings via Graph API? Thanks in advance!
403 Forbidden when sending mail with app-only token via Microsoft Graph
Hello, I am trying to send emails from my Outlook account using a registered enterprise application in Azure AD. We created an application registration in our tenant, assigned the relevant users, and granted admin consent for these Microsoft Graph application permissions: Mail.Send and Mail.ReadWrite and Mail.Send.Shared. I authenticate with application credentials (client_id, client_secret, tenant_id) and successfully retrieve an app-only access token using MSAL in Python: def get_access_token() -> str: load_dotenv() client_id = os.getenv("CLIENT_ID") client_secret = os.getenv("CLIENT_SECRET") tenant_id = os.getenv("TENANT_ID") authority = f"https://login.microsoftonline.com/{tenant_id}" scopes = ["https://graph.microsoft.com/.default"] # app-only token app = msal.ConfidentialClientApplication( client_id=client_id, client_credential=client_secret, authority=authority ) result = app.acquire_token_for_client(scopes=scopes) if "access_token" not in result: raise RuntimeError(f"Auth failed: {result.get('error_description') or result}") return result["access_token"] The token is retrieved successfully. However, when I try to send an email with: GRAPH_BASE = "https://graph.microsoft.com/v1.0" def send_email(access_token: str, from_user: str, to_address: str, subject: str, body_text: str, save_to_sent: bool = True) -> bool: """ Sends a plain-text email via POST /users/{from_user}/sendMail using an app-only token. Returns True on success; raises HTTPError on failure. """ payload = { "message": { "subject": subject, "body": {"contentType": "Text", "content": body_text}, "toRecipients": [{"emailAddress": {"address": to_address}}], }, "saveToSentItems": bool(save_to_sent), } r = requests.post( f"{GRAPH_BASE}/users/{from_user}/sendMail", headers={"Authorization": f"Bearer {access_token}"}, json=payload, timeout=20, ) r.raise_for_status() return True …I get this error: 403 Client Error: Forbidden for url: https://graph.microsoft.com/v1.0/users/{from_user}/sendMail File "C:\mail\src\mail.py", line 53, in send_email r.raise_for_status() ~~~~~~~~~~~~~~~~~~^^ File "C:\mail\src\mail.py", line 111, in <module> send_email(token, from_user, to, "Hello from Microsoft Graph", "Hello Human") ~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ requests.exceptions.HTTPError: 403 Client Error: Forbidden for url: https://graph.microsoft.com/v1.0/users/{from_user}/sendMail where {from_user} is my actual mailbox address (e.g., email address removed for privacy reasons). Since the app has Mail.Send (Application) permission with admin consent, my understanding is that the app should be able to send mail on behalf of any user in the tenant using /users/{user}/sendMail. Is there another configuration step I am missing (e.g., Application Access Policy or mailbox-level Send As requirement)? Any guidance on why this 403 happens despite having Mail.Send application permissions with admin consent would be very helpful. Thank you!Granting App ability to change group memberships by making it an owner?
Hello, We'd like an app to be able to control memberships of only certain security groups using app-based authentication. Today it is documented that a GroupMember.ReadWrite.All role is needed to do this on the app registration: https://learn.microsoft.com/en-us/graph/api/group-post-members?view=graph-rest-1.0&tabs=http This, however, grants access to the app to make changes to any group. However, we have noticed that API calls to change memberships work on groups owned by the Service Principal. For example, if I make a call to the API below for memberships and the app is assigned as the owner of the group, it works. https://graph.microsoft.com/v1.0/groups/{{group-id}}/members/ Is this a supported mechanism? I don't see it documented anywhere.The requesting principal is not authorized to set group preferred data location
We have our tenant with 4 Geo locations. And inside power automate flow I am sending this Graph Api to create a new security group under specific Geo location:- but I am getting this error:- The requesting principal is not authorized to set group preferred data location. Now if i remove this parameter:- "preferredDataLocation": "AUS", the Office 365 group will get created under the default location, but I need to add it to the specific location. the service account running the graph Api call has SharePoint, group and teams admin permissions. any advice? Thanks
Graph API : Authorization_RequestDenied Message: Insufficient privileges to complete the operation.
Hi Team, I have a Graph app and user configured with the following resourceAccess scopes: Code "resourceAccess": [ { "id": "06da0dbc-49e2-44d2-8312-53f166ab848a", "type": "Scope" }, { "id": "9c7a330d-35b3-4aa1-963d-cb2b9f927841", "type": "Scope" }, { "id": "e1fe6dd8-ba31-4d61-89e7-88639da4683d", "type": "Scope" }, { "id": "b340eb25-3456-403f-be2f-af7a0d370277", "type": "Scope" } ] However, when trying to pull presence data, I receive the following error in Postman: Code StatusCode: Forbidden Message: Code: Authorization_RequestDenied Message: Insufficient privileges to complete the operation. Graph Explorer also fails to return presence for a specific user using: https://graph.microsoft.com/beta/users/{user-id}/presence But the endpoint for the signed-in user works fine: https://graph.microsoft.com/beta/me/presence Admin consent has been granted, and even the Global Admin cannot retrieve presence for other users. Other permissions work fine — the app can list users and connect without issue. Presence is the only operation failing. Question: How can I investigate this behavior in Azure/Entra using the request-id or client-request-id from the error response? Or what could cause this behavior? Thanks in advance!
Query Regarding Duplicate Message IDs from Microsoft Graph API
Hello Microsoft Support Team, I am currently using the Microsoft Graph API to fetch email messages from the inbox of a my support email in my PHP application. However, I am encountering an issue where the API returns duplicate message IDs for emails. This is causing problems as emails with the same id are being processed multiple times, which results in duplicate ticket creation in my CRM system. To avoid this, I am currently checking and skipping duplicate IDs manually in my application. However, I would like to understand the root cause of these duplicates and whether there is an official recommendation or best practice to handle such cases effectively. Here are some additional details: API Endpoint: GET graph.microsoft.com/beta/users/$userEmailEncoded/mailFolders/Inbox/messages?\$top=20&\$orderby=receivedDateTime%20desc Issue: Duplicate message IDs (id) returned for the same email. Current Handling: I am skipping already processed emails using a tracking for message IDs to prevent duplicate ticket creation. Additionally, I have a few more queries regarding the use of internetMessageId and fetching attachments: Problem with internetMessageId: When I use internetMessageId, the internetMessageId of a replied message returns null. How can I use this ID effectively to manage or track message threads and replies? Attachments with internetMessageId: Is it possible to fetch attachments for a message using the internetMessageId? I am trying to retrieve attachments for a specific email using this ID, but I am not sure how to do this efficiently. Could you please advise on the following: Is there a recommended way to handle or filter out duplicate emails when fetching email data from the Graph API? Is there any mechanism in the API to ensure unique messages, especially when calling this endpoint frequently? How can I properly use internetMessageId for tracking message threads and replies, and why is it returning null for replied messages? Can I retrieve attachments using internetMessageId or is there another method for doing so? I would greatly appreciate any guidance or suggestions you can provide. Thank you for your time and assistance. Best regards, Krishna Adroja email address removed for privacy reasonsThe specified object was not found in the store., The process failed to get the correct properties.
Hi, I've set up a change notification using the Microsoft Graph API so that Microsoft sends webhook notifications to our server whenever a new email arrives in a specific mailbox. Each notification includes the ID of the new email. Our server then uses this ID to retrieve the email body via an HTTP GET request to Microsoft Graph. However, we've encountered a few instances where the server receives a error when attempting to retrieve the email. The error message is: Error Message: Exception: Microsoft.Graph.Models.ODataErrors.ODataError: The specified object was not found in the store., The process failed to get the correct properties. Has anyone experienced this before or have any insights into why this might be happening? Thanks!
Mail delivery fail when I Add events to Calendar
Hello I have a Contoso tennant for Developer tasks We are creating one web app for room reservations in a corporation using 365 accounts After some "ok" tests, the reservation has started to fail because the sender has been put in Spam list the fail message email that the sender email account get is Your message wasn't delivered because the recipient's email provider rejected it. Remote server returned '550 5.7.501 Service unavailable. Spam abuse detected from IP range... The api we are using use the calendar var res = await graphClient.Users[currUserId].Calendar.Events .Request() .AddAsync(evento); Any trick to avoid this problem? Thank you in advance Bruno
Graph API Issue to Search and GetContent from sharepoint
Hello, I’m using MS Graph to integrate an application with SharePoint. I’ve already implemented all the necessary requirements to query files, create folders, upload files, and download them. However, I’m facing an issue and have tried different ways to resolve it, unfortunately without success. When I upload a file, it completes successfully—confirmed both by the API response and by visually checking SharePoint. However, when I query the file using the Search API (`https://graph.microsoft.com/v1.0/drives/" + IdDirectory + "/search(q='{" + FileName + ".pdf}')`), the response is empty. In some cases, the expected result does appear, but only after several minutes (around 15 to 20 minutes). While debugging my application, I’ve confirmed that the search parameters are correct. Has anyone else experienced this? And if so, was there a solution?
