Issue with Teams RSC Permission TeamMember.Read.Group
I want to use Teams RSC to allow a bot to add and remove members of (private) teams channels. https://learn.microsoft.com/en-us/microsoftteams/platform/graph-api/rsc/resource-specific-consent#supported-rsc-permissions the API scope ChannelMember.ReadWrite.Group is appropriate for that. -> "Read and write the members of this team's channels." I have created a teams app and added the RSC API application scope (ChannelMember.ReadWrite.Group) to the App manifest and published the app to my org. The app has the "team" scope. Then I installed the app in a team and tested the API access. I sign-in with the Application SP using app-only auth. What is working: I can read the members of a public channel in the team using: invoke-mggraphRequest -Uri https://graph.microsoft.com/v1.0/teams/[team id]/channels/[channel id]/members -Method Get I can also read the members of a shared channel in the team using the same request. What is not working: I cannot access a private channel in the team: The above request yields the response: "code":"Forbidden","message":"Caller does not have the required roles for accessing 'Private' channel data. To access 'Private' data, API requires one of 'ChannelMember.Read.All, ChannelMember.ReadWrite.All, Group.Read.All, Directory.Read.All, Group.ReadWrite.All, Directory.ReadWrite.All'. Roles on the request 'Group.Selected'." I cannot remove a member from a shared channel. The request: invoke-mggraphRequest -Uri https://graph.microsoft.com/v1.0/teams/[team id]/channels/[channel id]/members/[member id] -Method Delete yields the error: "code":"Forbidden","message":"Caller app is not enabled for requesting the channel of 'Shared' channel type. To access channel data app has to be enabled in the requesting channel." Has someone successfully used the RSC TeamMember.Read.Group in a shared or private channel? Why does the API not work in private channels and only for read in shared channel? The documentation says "of this team's channels", it does not mention any restriction to public channels. Also a write scope only to public channels does not make sense, as members of a public channel are inherited from the team and cannot be managed seperately. What do I need to do differently to be able to read and modify members of private and shared channels in a team using RSC permissions?
MS Purview InformationProtectionPolicy - Extract Sensitivity Labels - Permissions Granted
Hello community, I'm currently facing an issue trying to extract sensitivity labels from our Microsoft 365 tenant and could use some assistance. I have already ensured that the necessary permissions and application are in place. I initially attempted to retrieve the labels via the Microsoft Graph Explorer (graph-explorer) using the endpoint: https://graph.microsoft.com/beta/security/informationProtection/sensitivityLabels. As you can see in the attached image, I encountered a "Forbidden - 403" error, suggesting a problem with permissions or consent, even though InformationProtectionPolicy.Read is listed under the "Modify permissions" tab as "Unconsent". The only way that I found to solve it was using "https://graph.microsoft.com/beta/me/security/informationProtection/sensitivityLabels" but I need to use it in Python Code, without a user validation of credential. Next, I tried to achieve the same using Python and the Microsoft Graph API directly. I obtained an access token using a Client ID and Secret, authenticating against https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/token. The application associated with this Client ID and Secret has been granted the InformationProtectionPolicy.Read permission. However, when making a GET request to https://graph.microsoft.com/beta/security/informationProtection/sensitivityLabels in Python, I receive the following error: I have already granted what I believe are the relevant permissions, including InformationProtectionPolicy.Read.All, InformationProtectionPolicy.Read, Application.Read.All, and User.Read. Has anyone successfully retrieved sensitivity labels using the Microsoft Graph API? If so, could you please share any insights or potential solutions? I'm wondering if there are other specific permissions required or if there's a particular nuance I might be missing. Any help would be greatly appreciated! Thank you in advance. Leonardo Canal
Microsoft Teams Bot OAuth login shows blank screen and closes without signing in
I’m building a Microsoft Teams bot using Azure AD OAuth (SSO) with Bot Framework. When I click Sign in, the OAuth popup in Teams shows a blank screen for a moment, then closes automatically without signing me in. What I’ve Done Added redirect URI in Azure App Registration: https://token.botframework.com/.auth/web/redirect Enabled Access tokens and ID tokens in App Registration → Authentication. Configured OAuth connection in Bot Channels Registration (ConnectionName matches my bot code). Verified client ID, client secret, and tenant ID are correct. Code bot.js require("dotenv").config(); const { TeamsActivityHandler } = require("botbuilder"); const { Client } = require("@microsoft/microsoft-graph-client"); const { DialogSet, DialogTurnStatus, OAuthPrompt, WaterfallDialog } = require("botbuilder-dialogs"); require("isomorphic-fetch"); const OAUTH_PROMPT = "OAuthPrompt"; const MAIN_DIALOG = "MainDialog"; class BotActivityHandler extends TeamsActivityHandler { constructor(conversationState, userState) { super(); this.conversationState = conversationState; this.userState = userState; this.dialogState = this.conversationState.createProperty("DialogState"); this.dialogs = new DialogSet(this.dialogState); // OAuthPrompt for Teams SSO this.dialogs.add( new OAuthPrompt(OAUTH_PROMPT, { connectionName: process.env.CONNECTION_NAME, text: "Please sign in to continue", title: "Sign In", timeout: 300000, }) ); this.dialogs.add( new WaterfallDialog(MAIN_DIALOG, [ this.promptStep.bind(this), this.handleFileStep.bind(this), ]) ); this.onMessage(async (context, next) => { const text = (context.activity.text || "").trim().toLowerCase(); const dialogCtx = await this.dialogs.createContext(context); if (text.startsWith("/")) { // ...handle commands... } else { const results = await dialogCtx.continueDialog(); if (results.status === DialogTurnStatus.empty) { if (context.activity.attachments?.length > 0) { await dialogCtx.beginDialog(MAIN_DIALOG, { file: context.activity.attachments[0], }); } else { await context.sendActivity("Upload a file or type /help."); } } } await next(); }); } async promptStep(stepContext) { return await stepContext.beginDialog(OAUTH_PROMPT); } async handleFileStep(stepContext) { const tokenResponse = stepContext.result; if (!tokenResponse?.token) { await stepContext.context.sendActivity("Please sign in to access files."); return await stepContext.endDialog(); } const token = tokenResponse.token; // Use token with Microsoft Graph API // ... return await stepContext.endDialog(); } } module.exports.BotActivityHandler = BotActivityHandler; Problem OAuth popup appears, then closes without completing login. No token is returned to the bot. Questions Why does the OAuth popup in Teams close immediately without signing in? Where can I see detailed error logs for OAuth failures? Azure AD sign-in logs? Application Insights (do I need to configure Instrumentation Key in Bot Service)? Environment Bot Framework v4 (Node.js) Azure Bot Service Microsoft Teams channel Azure AD v2 OAuth
Graph API 1.0 - Listing lists doesn't return all lists (todoTaskList)
Hi, first time posting here, please let me know if I should be doing something differently! I've searched throughout the internet and couldn't find a reason for this. I've got a couple of users running into a problem where the https://learn.microsoft.com/en-us/graph/api/todo-list-lists?view=graph-rest-1.0&tabs=http endpoint only returns one list (Flagged Emails), though these users have and see many other lists in the To Do desktop (macOS) app. I've confirmed in both cases it's the same user that's identified in my app/integration and in the desktop app. They can see the tasks in that list without a problem. There are no errors requesting that list, and asking via `/users/{id|userPrincipalName}/todo/lists` also returns the same response (with that one list). Is there any known situation where this could be happening? Am I missing something obvious? Is there something else I should be trying? I've got many other customers using the To Do integration without a problem. I'm aware "My Day" and a few other special lists aren't returned. Thank you so much!
Can a Teams Channel name start with space?
Dear Community, I am facing an issue fetching the children of a teams channel when the channel name is renamed and starts with empty space. Ex: Original Channel Name: "Test" Renamed Channel Name: " Test 123" This page does not mention anything on this https://learn.microsoft.com/en-us/microsoftteams/limits-specifications-teams Any help or hints are much appreciated. Thanks Pramod Vedala"Insufficient privileges to complete the operation" when listing Planner tasks from Project
Hi, it's only my time posting here, please let me know if I should be doing something differently! I've searched throughout the internet and couldn't find a solution for this. I've got a user running into a problem where the `/me/planner/tasks`, `/planner/buckets/{bucketId}/tasks`, and `/planner/plans/{planId}/tasks` endpoints return a `Authorization_RequestDenied` error. Here's an example response: { "code": "Authorization_RequestDenied", "message": "Insufficient privileges to complete the operation.", "innerError": { "date": "2025-07-23T08:15:50", "request-id": "bd5f7056-a41d-439c-a0d7-d768cd82d1ea", "client-request-id": "362f376c-863e-0616-86f7-22c7c07c1352" } } While this happens for almost all of their groups and plans, it doesn't happen for one. The main difference between that which works and the other ones which don't is that all the ones that don't work were created in Microsoft Project (Platinum, I think?). The one that does was created in Planner. We can, however, list the proper plans and buckets, just not fetch the tasks. Is there any way around this? Is there some kind of special scope I should be asking for so the API calls work? Should I use the To Do API in some special way for this, instead? Thank you so much!
How to add Metadata to Groups
Hello, I am getting quite frustrated with any kind of metadata in Entra ID especially on groups. I used to put a lot of information like product , responsible , location etc. in either the name or the description of a group but since this information is most of the time confusing and irrelevant for the members of the group, I wanted to come up with something better. Now it seems that for some reason Microsoft denies any kind of metadata in Entra ID to be added to most objects especially groups. Overall it seem Microsoft does not see value in providing tags similar to the ones in Azure to any object type in Entra ID and I wonder why is that? I checked out the new "Custom Security Attributes" feature, turns out, its only available for users and applications.... Then I thought we are using directory extensions on applications and users already, it would be useful to use on groups as well. Now according to the documentation groups are also supported, great. But then there is the limitation that you can not update mail enabled and distribution groups via Graph API 😡. Well majority of groups are mail enabled.... Now I am forced to use the EXO module which limits the possibility of automating this quite much (requires PowerShell) but even with this you can not set directory extensions. Why is this so bad by design? How can I add metadata to groups now? Cheers
Missing added files (v1.0/me/drive/recent?$top=1000)
Missing added files In LMS we allow customers to add recent files across organization as course materials. We fetch recent files via graph API call https://graph.microsoft.com/v1.0/me/drive/recent?$top=1000 . Typical scenario for adding files would be the following. 1) user puts file from his PC to whatever location in sharepoint 2) he edits course and sees his file, and its added Currently user won't be able to see his files. Just uploaded files by user are missing from this query results. To make files appear user have to go to sharepoint and click Preview, then Download, then try rename files to make them appear in the query results. It would be very uncofmortable for user (and for our support to explain) to do it to make files appear. Can you please show just added files in https://graph.microsoft.com/v1.0/me/drive/recent?$top=1000 call. Just in case we contacted Microsoft Support 3 times already 2 years ago with no promises to fix it, but new client has same situation, so I decided to post it here as well. Thanks.Replies not included when retrieving messages using GraphApi
Hi Team, We've noticed that when we retrieve a message using the https://learn.microsoft.com/en-us/graph/api/chatmessage-get?view=graph-rest-1.0&tabs=http for a message that is a reply to another message we are missing an attachment. This only happens to message that are sent by a Teams bot. These attachments used to always be present for replies but now are missing. Steps to reproduce Start the Echo bot from the sample templates (I used Teams Toolkit to deploy it to Teams or run it in the Test tool). In addition, I followed http:// https://learn.microsoft.com/en-us/graph/tutorials/typescript-app-only?tabs=aad to add the graph Api to my bot. Give the permission ChatMessage.Read.All to the application created by the Teams Toolkit. In the graphHelper.ts file, add the following function: export async function getMessage(conversationId: string, messageId: string) : Promise<any> { return _appClient.api('/chats/'+conversationId+'/messages/'+messageId) .get(); } In the TeamsBot.ts file, modify the onMessage function by replacing await context.sendActivity(...) with the following code. const message = await getMessage("19:email address removed for privacy reasons.spaces", context.activity.id); if (message.attachments.length == 0) { await context.sendActivity("No reply message found"); } else { await context.sendActivity("Reply message found<br/>" + message.attachments[0].content); } Note: For simplicity the conversation Id is hard coded with the one used for my tests here Observed behaviour: First case: Message with no reply We don't receive any attachment as expect because this not a reply message. Second case: Message that replies to my own message. We receive an attachment as expected because this is a reply message Third case: Message that replies to a bot message We don't receive any attachment. This is unexpected as this is a message reply. The third case is surprising to us as it used to work the same way as the second case but now we get an inconsistent behaviour. Can you advise if this is an expected behaviour ? Is there a workaround to simply parse message replies ? Thank you !
