Access denied Microsoft Graph Deamon App with SDK Outlook List of Events, with Rights set

Question

Hi Roboter

Access denied Microsoft Graph Deamon App with SDK Outlook List of Events, with Rights set

I have set up a new application in Azure and reset the permissions several times. (see the Permissions below)

But unfortunately it does not work

I wonder why the Event.add, Event.update and Event.delete queries work, but the listing does not.
All rights I have setup the rights on.
Can someone please give me correct and qualified information why it does not work?

Many Thanks

Here is the code for creating the GraphserviceClient.

public GraphServiceClient GetGraphClientWithIdentity() {

        if (_graphServiceClient != null)
            return _graphServiceClient;

        var instance = _configuration.GetValue<string>("AzureAd:Instance");
        var apiurl = _configuration.GetValue<string>("AzureAd:ApiUrl");
        var tenant = _configuration.GetValue<string>("AzureAd:Tenant");
        var tenantId = _configuration.GetValue<string>("AzureAd:TenantId");
        var clientId = _configuration.GetValue<string>("AzureAd:ClientId");
        var clientSecret = _configuration.GetValue<string>("AzureAd:ClientSecret");
        string[] scopes = new[] { "https://graph.microsoft.com/.default" };
        
        //var authority = String.Format(CultureInfo.InvariantCulture, instance, tenant);

        // TokenCredentialOptions for Cloud
        var options = new TokenCredentialOptions
        {
            AuthorityHost = AzureAuthorityHosts.AzurePublicCloud
        };

        var clientSecretCredential = new ClientSecretCredential(tenantId, clientId, clientSecret, options);
        var graphClient = new GraphServiceClient(clientSecretCredential, scopes);

        return graphClient;

    }

Here is the code for the requests that work.

// Create Client
var graphClient = _graphClient.GetGraphClientWithIdentity();
// OK
users = await graphClient.Users.Request().GetAsync(); calendars = await graphClient.Users[userid].Calendars.Request().GetAsync(); mailfolders = await graphClient.Users[userid].MailFolders.Request().GetAsync(); organizations = await graphClient.Organization.Request().GetAsync(); categories = await graphClient.Users[userid].Outlook.MasterCategories.Request().GetAsync();  var evsendInsert = await graphClientService.Users[userid_1].Events.Request().AddAsync(@event); // Event Update OK var evsendUpdate = await graphClientService.Users[userid_1].Events[eventid].Request().UpdateAsync(@event); // Event Delete OK await graphClientService.Users[userid_1].Events[eventid].Request().DeleteAsync();

// Do not Work
var events = await graphClient.Users[userid].Events.Request().GetAsync();
var events = await graphClient.Users[userid].Calendars[firstCalendarID].Events.Request().GetAsync();

The rights

Calendars.Read

Calendars.ReadBasic.All

Calendars.ReadWrite

Directory.Read.All

Directory.ReadWrite.All

Group.Read.All

Group.ReadWrite.All

Mail.Read

Mail.ReadBasic

Mail.ReadBasic.All

Mail.ReadWrite

Mail.Send

User.Read

User.Read.All

User.ReadBasic.All

User.ReadWrite.All

Answer 1

Any News about this?

Answer 2

Hi @Reto Rümmeli , I set the same permissions as you and can reproduce the same error. Then after my testing, I found that when the Calendars.ReadBasic.All permission was granted, I couldn't list events. When the Calendars.ReadBasic.Allpermission is removed, the API can run successfully.

It looks like the Calendars.ReadBasic.All permission conflicts with other permissions.

Hope that can help you. Best Wishes.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.