Issues generating application access policy on application to create an online meeting through the graph api

Question

Issues generating application access policy on application to create an online meeting through the graph api

Susana Lau 20

We've been trying to generate a meeting using the api https://graph.microsoft.com/v1.0/users/object-id/onlineMeetings

Where object-id is well, the object-id linked to our global admin user.

The issue we are having is that we get the error "No Application Access Policy found for this app", looking through the documentation we found this link on how to create and assign the application access policy https://learn.microsoft.com/en-us/graph/cloud-communication-online-meeting-application-access-policy

But when trying to run the commands from https://shell.azure.com/ we are getting a 404 error.

To be more specific, when running the command New-CsApplicationAccessPolicy, this error appears:

New-CsApplicationAccessPolicy: The remote server returned an error: (404) Not Found.

Also it may be relevant but when trying to connect through the shell console using our admin credentials:

$userCredential = Get-Credential
Connect-MicrosoftTeams -Credential $userCredential

This error appears:

Connect-MicrosoftTeams: One or more errors occurred. (Unsupported User Type 'Unknown'. Please see https://aka.ms/msal-net-up. )

Connect-MicrosoftTeams: Unsupported User Type 'Unknown'. Please see https://aka.ms/msal-net-up.

Connect-MicrosoftTeams: Object reference not set to an instance of an object.

And just in case, our username is our email and our normal azure password.

Thanks in advance!

Answer accepted by question author

0 additional answers

Your answer

Answer 1

CarlZhao-MSFT 46,406

Hi @Susana Lau

To do this, I created a new tenant and reproduced your issue. It seems that a Microsoft 365 license is missing from your tenant, which is what is causing the issue.

Before:

User's image

After:

User's image

Hope this helps.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.

Susana Lau 20 Reputation points

2023-02-23T18:04:13.9733333+00:00

Hello Carl,

Thanks for the answer!

With that i was able to use the Connect-MicrosoftTeams correctly with an enterprise user.

I gave the user the owner role for the subscription and also the Global Admin to the active directory.

I confirmed that the Get-AzContext gives the same information as Connect-MicrosoftTeams, i had to run the command Connect-AzAccount -UseDeviceAuthentication with the new user i created but the information matches.

But i still get the same 404 error when trying to create the application access policy with the New-CsApplicationAccessPolicy command.
CarlZhao-MSFT 46,406 Reputation points

2023-02-24T10:28:28.58+00:00

Hi @Susana Lau

Make sure your tenant is an enterprise-level tenant. If your tenant is created by MSA (i.e. personal account) then users in that tenant will cause this error even if they have administrator role.
Susana Lau 20 Reputation points

2023-02-24T22:19:13.9266667+00:00

Hello @CarlZhao-MSFT

Thanks for your response, when you say the tenant should be enterprise-level, you mean we need a special type of azure subscription (an enterprise subscription?) to be able to call the create application access policy command?

Because the user that we created should belong to the enterprise tier it even has the ".onmicrosoft.com" extension part on the email.

That user also is in the list of users in our enterprise application view and also has owner permissions for the enterprise application.

Trying some different stuff i subscribed my account to the Azure AD Premium P2 trial and linked a license to the enterprise user i created but still got no results.

Also since our issue comes from trying to create the application access policy using the command New-CsApplicationAccessPolicy and this command belongs to the Business Online Connector module. I wanted to know if the shell.azure portal has that module by default, because using the command Get-Module -ListAvailable i was not able to find it.

So i thought that maybe the command throwed the 404 error because indeed it cant find the module.

I tried installing Import-Module MicrosoftTeams but to no avail
CarlZhao-MSFT 46,406 Reputation points

2023-02-27T10:19:40.1+00:00

Hi @Susana Lau

Can you share a screenshot of the error?
Susana Lau 20 Reputation points

2023-02-27T16:24:20.8233333+00:00
Hello

Of course, in the screenshot i include connecting to AzACcount and to MicrosoftTeams before trying to run the command to create the policy.

It seems like the command its recognized because it asks for the identity parameter, but then it returns the 404.

shell-404-error.png

Also another question, which one of these options would register an enterprise-level tenant just to be sure:

upgrading to Azure Active Directory Premium P1 or P2

creating a new tenant as the new @onmicrosoft Global Admin
CarlZhao-MSFT 46,406 Reputation points

2023-02-28T08:41:10.61+00:00

Hi @Susana Lau

To do this, I created a new tenant and reproduced your issue. It appears that the O365 Team license is missing from your tenant, which may be the cause of the issue.

Before:

After:

Hope this helps.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.
Susana Lau 20 Reputation points

2023-02-28T21:23:35.7033333+00:00

Thanks for your help @CarlZhao-MSFT

It seems like indeed we were missing the teams 365 license so we got the microsoft 365 business trial to test it out and with that we were able to create the access policy and also grant the access!

I only have a last question, there are various business licenses and we used the trial for the premium one just in case but.

Could everything have worked with the 365 Business basic license? or it only works with premium?
CarlZhao-MSFT 46,406 Reputation points

2023-03-01T02:10:06.8533333+00:00

Hi @Susana Lau

The Microsoft 365 Business Basic license alone is sufficient, and it includes Teams services.
CarlZhao-MSFT 46,406 Reputation points

2023-03-01T02:29:28.3666667+00:00

Hi @Susana Lau

I made some changes to the answer, if it helps you, you can accept it as the answer to the question. Thank you!

Share via

Issues generating application access policy on application to create an online meeting through the graph api

0 additional answers

Your answer