Correct Permissions to access List Retention Labels Api

I finally was able to get this api to work.

The problem was that I was not using the Delegated RecordsManagement.Read.All, I was using the Application RecordsManagement.Read.All permissions. Both permissions were set up on my application within Active Directory, but the way I was retrieving my tokens was incorrect.

When it wasn't working, I was using a token generated by the following curl request:

# Auth v2.0  
curl -X "POST" "https://login.microsoftonline.com/{TENENT_ID}/oauth2/v2.0/token" \  
     -H 'Content-Type: application/x-www-form-urlencoded' \  
     --data-urlencode "response_type=client_credentials" \  
     --data-urlencode "client_id={CLIENT_ID}" \  
     --data-urlencode "client_secret={CLIENT_SECRET}" \  
     --data-urlencode "grant_type=client_credentials" \  
     --data-urlencode "scope=https://graph.microsoft.com/.default"  

This generated a token with Application RecordsManagement.Read.All permissions that resulted in a response to

# Get security labels  
curl "https://graph.microsoft.com/beta/security/labels/retentionLabels" \  
     -H 'Authorization: Bearer {TOKEN}' \  
     -H 'Content-Type: application/json'  

of

{  
  "error": {  
    "code": "UnknownError",  
    "message": "No MediaTypeFormatter is available to read an object of type 'WorkbenchResponse`1' from content with media type 'application/xml'.",  
    "innerError": {  
      "date": "2022-10-20T19:01:46",  
      "request-id": "a8e82d9a-9887-494f-b76f-2a0b4befd2a5",  
      "client-request-id": "a8e82d9a-9887-494f-b76f-2a0b4befd2a5"  
    }  
  }  
}  

---
You need to do the following in order to make it work.

1. Give your app the Delegated RecordsManagement.Read.All permissions
2. Follow this OIDC/OAUTH flow here https://learn.microsoft.com/en-us/graph/auth-v2-user in order to get a token with the correct version (Delegated) of the
   RecordsManagement.Read.All permission.
3. Use the token generated from that flow in your request to GET https://graph.microsoft.com/beta/security/labels/retentionLabels

Hi @Mullins, Christopher ,
Per my test, RecordsManagement.Read.All is the right permission to access List Retention Labels.

Please decode your token in the following web
https://jwt.ms/
Then you can check if there is RecordsManagement.Read.All permission in role claim. If there is no such permission, you can try use client credentials flow to register the token. Please refer to following document
https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.