graph api - servicehealth endpoint throwing 403 forbidden

Question

Suddenly I have started receiving the 403 Forbidden error while trying to use the /admin/serviceAnnouncement/healthOverviews graph api endpoint using SPFx (which use SharePoint Online Client Extensibility Web Application Principal Azure app) and I have been using it for past 6 months and never faced this issue. The same endpoint works with the graph explorer.

Below are the details of the approved graph permissions in the azure portal

Below is the token

Below is the error

Answer 1

Hi Harminder,

Good afternoon and thank you for your question. I tested also the endpoint on Graph Explorer and it is working fine. It seems to be that there is an issue from the application itself.

Can you check if the token that you're using on the application is fine and if you're using Delegated (Personal microsoft account)?

Answer 2

I'm experiencing the same problem for both of my tenants and I know of 2 others who are experiencing this problem as well. Nothing has changed on the application. All permissions are verified and working for numerous other Graph endpoints (/applications, /organizations, /subscribedSkus, /teams, etc.) Again, the application has NOT changed, the permissions and app registration have NOT changed. The same Delegated user credential and app registration is used for all other calls to Graph successfully. Only the /admin/serviceAnnouncement/healthOverviews is failing with 403 Forbidden as the OP described above. So what has changed with Graph??

Answer 3

Hello, I have the same probleme from a SPFx WebPart, all is working well exept "/admin/serviceAnnouncement/healthOverviews" and "/admin/serviceAnnouncement/issues" that return 403 errors.

Working well from postman or graph explorer, but token from SPContenxt does not work.

Is there any news or solutions ?

Thanks,

Cheers

Answer 4

The user account now requires the Message Center Reader role to view service status stuff, regardless of the app registration delegated permissions. Add this role to your monitoring account and your Services monitoring (and discovery) should return to normal. Changes to the role assignment might take a few minutes to become recognized.

https://monitoringguys.com/2023/07/28/graph-api-healthoverviews-403-forbidden/