ProfileAccessDeniedException on profile picture endpoint with correct permissions

⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀ 1 Reputation point
2022-11-10T23:19:33.283+00:00

I'm trying to implement MSAL login in an app and it needs a profile picture. When trying to get it via https://graph.microsoft.com/me/photo/$value, I get the following response: 

{"error":{"code":"ErrorInsufficientPermissionsInAccessToken","message":"Exception of type 'Microsoft.Fast.Profile.Core.Exception.ProfileAccessDeniedException' was thrown.","innerError":{"date":"redacted","request-id":"redacted","client-request-id":"redacted"}}}

According to the API reference linked above, getting the profile picture for an account requires the User.Read permission (for access with least priveliges). I do obtain the pernission, and the consent screen agrees.
259253-screenshot-2022-11-10-at-230657.png
Just to make sure, I did test switching this out for User.Read.All and this made no difference.

What do I do to stop this exception happening?

Microsoft Graph
Microsoft Graph
A Microsoft programmability model that exposes REST APIs and client libraries to access data on Microsoft 365 services.
10,582 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,464 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Vicky Kumar (Mindtree Consulting PVT LTD) 1,156 Reputation points Microsoft Employee
    2022-11-12T05:29:40.823+00:00

    Could you please try to check the scopes by decoding access token in https://jwt.ms/ and make sure you have User.Read.All, application permissions,

    please see the docs - https://learn.microsoft.com/en-us/graph/api/user-get?view=graph-rest-1.0&tabs=http

    Hope this helps

    Thanks