Graph API delta request with deltatoken or skiptoken returns ErrorAccessDenied for shared resources

Aneta Skoczylas 1

I'm having trouble retrieving contacts and messages from a shared account using the delta request.

The scenario is as follows:

User 1 shares their contacts with User 2 in the desktop Outlook app:

User 2 sends a request from Postman or Graph Explorer:

GET https://graph.microsoft.com/v1.0/users/{{User 1}}/contacts

The contacts are returned correctly.

User 2 sends a delta request to the same endpoint:

GET https://graph.microsoft.com/v1.0/users/{{User 1}}/contacts/delta

The contacts are also returned correctly, along with @odata.deltaLink.

User 2 sends a GET request to the link from the @odata.deltaLink:

GET https://graph.microsoft.com/v1.0/users/{{User 1}}/contacts/delta?$deltatoken=LztZwWjo5...

After that, the server returns a 403 status:

{  
     "error": {  
         "code": "ErrorAccessDenied",  
         "message": "Access is denied. Check credentials and try again.",  
         "innerError": {  
             "date": "2022-10-11T13:30:21",  
             "request-id": "0330a098-8b43-4e9c-b2cf-006a6d1ce292",  
             "client-request-id": "9d3e4ec6-85b0-f32a-6989-9cd887cda89d"  
         }  
     }  
}

Is there something missing in my configuration? Here are the permissions:

Zehui Yao_MSFT 5,831 Reputation points

2022-10-12T08:04:45.24+00:00

Hi @Aneta Skoczylas , do you encounter permission issues with both Postman and Graph Explorer? Would you mind decode your token in https://jwt.ms/ to check if it contains the correct permission?

Aneta Skoczylas 1

@Zehui Yao_MSFT Yes, it's happening on both apps. The decoded token payload contains all Contacts permissions:

{  
  ...  
  "app_displayname": "Graph Explorer",  
  ...  
  "scp": "Calendars.Read Calendars.Read.Shared Calendars.ReadWrite Calendars.ReadWrite.Shared Contacts.Read Contacts.Read.Shared Contacts.ReadWrite Contacts.ReadWrite.Shared DeviceManagementManagedDevices.Read.All DeviceManagementManagedDevices.ReadWrite.All EAS.AccessAsUser.All EWS.AccessAsUser.All Mail.Read Mail.Read.Shared Mail.ReadBasic Mail.ReadWrite openid profile User.Read email",  
  ...  
}

Zehui Yao_MSFT 5,831 Reputation points

2022-10-13T07:40:11.307+00:00

Hi @Aneta Skoczylas , since I'm testing locally and everything is working fine, I recommend opening a support ticket for more detailed help from a backend engineer.