Why is the access request required for Protected APIs in Microsoft Teams?

Question

According to the resources: https://learn.microsoft.com/en-us/graph/api/subscription-post-subscriptions?view=graph-rest-beta&tabs=http https://github.com/microsoftgraph/java-spring-webhooks-sample I've created the notification endpoints in my MS Teams bot, created two subscriptions for two different organizations, using the access token received by the client credentials flow for corresponding tenantId. And I could receive the notification of adding new messages in channels of two organization. Regarding to the documentation https://learn.microsoft.com/en-us/graph/teams-protected-apis I need to request the access for the protected API of subscription creating, but everything works well for two different organizations without such request. Why is such request required? And why is Creating subscription for new channel messages is protected?

Answer 1

Microsoft Teams APIs in Microsoft Graph that access sensitive data are considered protected APIs. So these APIs require that you have additional validation, beyond permissions and consent, before you can use them. For more info, refer and the list of APIs.