https://graph.microsoft.com/v1.0/education/classes/{educationClass-id}/assignmentDefaults will always return forbidden

Question

https://graph.microsoft.com/v1.0/education/classes/{educationClass-id}/assignmentDefaults will always return forbidden

Jonathan Anderson 170

As title assignment defaults will always return forbidden, when trying to patch, whether using graph explorer, Get-MgEducationClassAssignmentDefault with the powershell SDK and the python SDK. I've tried with both user and app scope application, many teams and all the required permissions.

Is there a workaround to setting assignment defaults in bulk I could use, and is this rest endpoint broken?

CarlZhao-MSFT 46,316 Reputation points

2023-09-07T06:37:09.6966667+00:00

Hi @Jonathan Anderson

Only teachers can perform this operation.
Jonathan Anderson 170 Reputation points

2023-09-07T06:41:34.7466667+00:00

I read over that part, but what is it refering to? Does teams differentiate between teachers and owners of a team? Adding an admin account as an owner of the team didn't fix this, and interestingly I couldn't get the assignment defaults unless I was running an app with application (.all) scope, and then I wasn't able to patch them.

Thanks for the reply, that part definitely stumped me yesterday though
CarlZhao-MSFT 46,316 Reputation points

2023-09-07T06:56:41.29+00:00

Can you use jwt to parse your access token and share screenshots?
CarlZhao-MSFT 46,316 Reputation points

2023-09-07T06:59:08.8966667+00:00

The owner of the team/group has teacher status.

Jonathan Anderson 170

The scopes allocated are as follows:

	Calendars.ReadWrite Chat.Read Chat.ReadBasic Contacts.ReadWrite DeviceManagementApps.Read.All DeviceManagementConfiguration.Read.All DeviceManagementManagedDevices.Read.All DeviceManagementRBAC.Read.All DeviceManagementServiceConfig.Read.All EduAdministration.ReadWrite EduAssignments.Read EduAssignments.ReadBasic EduAssignments.ReadWrite EduAssignments.ReadWriteBasic EduRoster.ReadBasic Files.ReadWrite.All Group.ReadWrite.All IdentityRiskEvent.Read.All Mail.Read Mail.ReadWrite MailboxSettings.ReadWrite Notes.ReadWrite.All openid People.Read Place.Read Presence.Read Presence.Read.All PrinterShare.ReadBasic.All PrintJob.Create PrintJob.ReadBasic profile Reports.Read.All Sites.ReadWrite.All Tasks.ReadWrite TeamMember.ReadWrite.All TeamSettings.ReadWrite.All User.Read User.ReadBasic.All User.ReadWrite User.ReadWrite.All email

That's what I figured with the teacher status too, It's frustrating terminology when it just means owner IMO but I suppose microsoft have to reskin their application somehow :P

Interestingly I did find a workaround using onenotes API (https://assignments.onenote.com/api/v1.0/edu/classes/{classID}/defaultsAndSettings) and a user token but it's pretty hacky for now and involves having a user in every team, for anyone stumbling across this with the same issue I'll link it in the original post when I make a write-up.

3 answers

Your answer

CarlZhao-MSFT 46,316 Reputation points

2023-09-07T06:37:09.6966667+00:00

Hi @Jonathan Anderson

Only teachers can perform this operation.
Jonathan Anderson 170 Reputation points

2023-09-07T06:41:34.7466667+00:00

I read over that part, but what is it refering to? Does teams differentiate between teachers and owners of a team? Adding an admin account as an owner of the team didn't fix this, and interestingly I couldn't get the assignment defaults unless I was running an app with application (.all) scope, and then I wasn't able to patch them.

Thanks for the reply, that part definitely stumped me yesterday though
CarlZhao-MSFT 46,316 Reputation points

2023-09-07T06:56:41.29+00:00

Can you use jwt to parse your access token and share screenshots?
CarlZhao-MSFT 46,316 Reputation points

2023-09-07T06:59:08.8966667+00:00

The owner of the team/group has teacher status.
Jonathan Anderson 170 Reputation points

2023-09-07T07:06:41.44+00:00

The scopes allocated are as follows:

Calendars.ReadWrite Chat.Read Chat.ReadBasic Contacts.ReadWrite DeviceManagementApps.Read.All DeviceManagementConfiguration.Read.All DeviceManagementManagedDevices.Read.All DeviceManagementRBAC.Read.All DeviceManagementServiceConfig.Read.All EduAdministration.ReadWrite EduAssignments.Read EduAssignments.ReadBasic EduAssignments.ReadWrite EduAssignments.ReadWriteBasic EduRoster.ReadBasic Files.ReadWrite.All Group.ReadWrite.All IdentityRiskEvent.Read.All Mail.Read Mail.ReadWrite MailboxSettings.ReadWrite Notes.ReadWrite.All openid People.Read Place.Read Presence.Read Presence.Read.All PrinterShare.ReadBasic.All PrintJob.Create PrintJob.ReadBasic profile Reports.Read.All Sites.ReadWrite.All Tasks.ReadWrite TeamMember.ReadWrite.All TeamSettings.ReadWrite.All User.Read User.ReadBasic.All User.ReadWrite User.ReadWrite.All email

That's what I figured with the teacher status too, It's frustrating terminology when it just means owner IMO but I suppose microsoft have to reskin their application somehow :P

Interestingly I did find a workaround using onenotes API (https://assignments.onenote.com/api/v1.0/edu/classes/{classID}/defaultsAndSettings) and a user token but it's pretty hacky for now and involves having a user in every team, for anyone stumbling across this with the same issue I'll link it in the original post when I make a write-up.

Answer 1

Sebastian Cerazy 316

Any update?

I cannot make myself an owner of every Team just to change defaults!

edit:

As there is no better way I had to:

Get-Team | where-object {$_.DisplayName -like ("2023-*")} | Select-Object GroupId | Export-Csv c:\temp\GroupID.csv -NoTypeInformation 

Import-CSV -Path c:\temp\GroupID.csv | ForEach { 
Add-TeamUser -GroupId $_.id -User UPN -Role owner
}

Import-csv -path c:\temp\GroupID.csv | ForEach {
Update-MgEducationClassAssignmentDefault -EducationClassId $_.id -DueTime 09:00:00
}

Import-CSV -Path C:\temp\GroupID.csv | ForEach {
Remove-TeamUser -GroupId $_.id -User UPN
}

Jonathan Anderson 170 Reputation points

2023-11-20T12:56:48.4166667+00:00
Here's the notes I made for my wiki when I had this issue, adapt as you like : )

When managing huge amounts of teams classes, individually visiting each class team to change the assignment deadlines is out of the question. Ideally we'd be able to do this with Graph API, but unfortunately at time of writing the official endpoint for assignments PATCH /education/classes/{id}/assignmentDefaults is broken! To get around this we're going to use a user account with the correct permissions to visit each team and change the default assignment deadline. This can be done with a service account, which is a user account that logs into Teams and performs actions on behalf of the user.

This is not an officially recommended method, but as the official way doesn't work currently it's the working method. Using service accounts means you will be rate-limited more, but I haven't had any issues with this method as of yet.

The default assignment deadlines (and any other settings you'd like to change) can be found in the teams assignment settings. To get to this page, go to the assignments tab in a team and click on the cogwheel in the top right corner.

There are 7 settings we can change here, and I'll give the syntax and API endpoint needed for changing each one as well as the assignment deadline.

Assignment Settings

Setting up the service account

I would highly recommend not using any account that already exists, as joining more than a thousand teams will slow down the Teams client to a crawl. The new user account doesn't need anything more than the teams license.

Once the account is created, you can get the users ID by checking the URL of the users profile page. The ID is the last part of the URL, after the last slash. It will look something like this: 12345678-1234-1234-1234-123456789012

We can then add the user to all the teams classes as an owner (or as Microsoft calls it a teacher, but there is no functional difference) with the following powershell script. If you haven't used powershell with GraphAPI before you'll need to install the module with Install-Module Microsoft.Graph.

$scopes = "Group.Read.All", "User.ReadBasic.All", "TeamMember.ReadWrite.All" Connect-MgGraph -Scopes $scopes -NoWelcome $UserID = Read-Host -Prompt "Enter the user ID of the user to add to class teams" "Getting teams..." $teamRequest = @{ Uri = "https://graph.microsoft.com/v1.0/teams?`$select=id"; Method = 'Get' } $teams = while ($teamRequest.Uri) { $teamResponse = Invoke-MgGraphRequest @teamRequest $teamRequest.Uri = $teamResponse.'@odata.nextLink' $teamResponse.value } $classes = $teams | ForEach-Object -Begin { $progress = 0 } -Process { $uri = "https://graph.microsoft.com/v1.0/teams/$($_.id)?`$select=specialization,isArchived" $teamRequest = Invoke-MgGraphRequest -Uri $uri -Method Get $specialization = $teamRequest.specialization $isArchived = $teamRequest.isArchived if ($isArchived -eq $false -and $specialization -eq "educationClass") { $_ } $progress++ Write-Progress -Activity "Filtering teams" -Status "Teams filtered: $progress out of $($teams.Count)" -PercentComplete (($progress / $teams.Count) * 100) } $confirmation = Read-Host -Prompt "Add user to $($classes.Count) active classes? (y/n)" if ($confirmation -ne "y") { exit } "Adding user to teams..." $classes | Foreach-Object -Begin { $progress = 0 } -Process { $uri = "https://graph.microsoft.com/v1.0/teams/$($_.id)/members" $userUri = "https://graph.microsoft.com/v1.0/users/$UserID" $body = @{ '@odata.type' = 'microsoft.graph.aadUserConversationMember' 'roles' = @('owner') '******@odata.bind' = $userUri } Invoke-MgGraphRequest -Uri $uri -Method Post -Body $body > $null $progress++ Write-Progress -Activity "Adding user to teams" -Status "Teams added to: $progress out of $($classes.Count)" -PercentComplete (($progress / $classes.Count) * 100) }

Once the script has run (which may take a while depending on how many teams you have) you can check the users profile page on the teams admin console to check that the user has been added to all the teams classes you expected. If you have an excess of 5000 total teams you may want to remove the confirmation prompt and just run the script overnight as although it will only add the service account to class teams, it has to check every team in the tenant to find the specialized ones.

User added to teams

Finding the settings to change

Next up we can start changing the settings. The settings are changed with a PATCH request to the PATCH https://assignments.onenote.com/api/v1.0/edu/classes/(((_.id)/defaultsAndSettings endpoint. The body of the request is a JSON object with the settings we want to change. The settings I'll be changing here are default due time, whether students are added to assignments that are still active but created before they joined the team, and whether assignments should be automatically added to the students calendar. The settings can be changed in the same way with the following syntax:

Default times assignments are due:

"dueTime" = "HH:MM" (24 hour format)

#dd students to assignments created before they joined the team:

"addedStudentAction" = $True__ or $False__

Add assignments to calendars:

"addToCalendarActionAsEnum" = "none", "studentsOnly", "studentsAndPublisher" or "studentsAndTeachers"

#Enable late submission notifications for teachers:

"enableLateSubmissionNotifications" = $True or $False

To find these settings we can inspect the network traffic when changing the default settings in the Teams. The settings are found in the Request Payload and the authorization token is found in the Request Headers which we'll need for the next step.

Once we have the requests we want to make, edit the script below to include the settings you want to change. The script will prompt you for your user ID and then the token you copied from the network traffic.

$scopes = "User.Read.All" Connect-MgGraph -Scopes $scopes -NoWelcome $userID = Read-Host -Prompt "Enter the user ID of the service account" $token = Read-Host -Prompt "Enter the user token taken from browser" if (-Not $token.StartsWith("Bearer ")) { $token = "Bearer " + $token } $res = Invoke-MgGraphRequest -Uri "https://graph.microsoft.com/v1.0/users/${userID}/joinedTeams?`$select=id" -Method Get $classes = $res.value $header = @{ 'Authorization' = "${token}" 'Content-Type' = 'application/json' 'Accept' = 'application/json' } ## \/ Change the settings here \/ ## $body = @{ "defaults" = @{ "dueTime" = "22:00" "addedStudentAction" = $True "addToCalendarActionAsEnum" = "studentsOnly" } } | ConvertTo-Json ## /\ Change the settings here /\ ## $classes | Foreach-Object -Begin { $progress = 0 } -Process { $uri = "https://assignments.onenote.com/api/v1.0/edu/classes/$($_.id)/defaultsAndSettings" Invoke-WebRequest -Uri $uri -Method Patch -Body $body -Headers $header -ContentType "application/json" -UseBasicParsing > $null $progress++ Write-Progress -Activity "Updating teams settings" -Status "Teams updated: $progress out of $($classes.Count)" -PercentComplete (($progress / $classes.Count) * 100) }

This script will take a while to run, but once it's done you can check the assignment settings in the class teams to make sure they've been changed correctly.

Edits you might want to make in your own deployment of the script

Store the teams ID's you set so when you run the script again it only updates the settings for new teams When adding to new teams, finding the list of total classes and the list of classes the user is already in and only adding the user to the new classes
Sebastian Cerazy 316 Reputation points

2023-11-28T08:59:40.49+00:00

It took 5 days to clear my membership from all Teams, but it did in the end

Answer 2

A year later and the same code simply no longer works!

One machine 1 I get:

cmdlet Update-MgEducationClassAssignmentDefault at command pipeline position 1
Supply values for the following parameters:
EducationClassId: d710f1b9-bb50-4207-9d04-0c3e11f1f322
Update-MgEducationClassAssignmentDefault : One or more errors occurred.
At line:1 char:1

I went back to my management VM (that did not have cmdlets updated)

Still worked fine, but I had to REDO one more time

Connect-MgGraph -Scopes "EduAssignments.ReadWrite" , "EduRoster.ReadBasic" -TenantId 00000000-aaaa-bbbb-cccc-dddddddddddd

Answer 3

Jonathan Anderson 170

Still not fixed, but anyone needing the same endpoint can follow this:

https://jheesbrough.dev/articles/how-to-change-the-default-settings-for-teams-assignments-in-bulk

Until the endpoint works as intended.

Share via

https://graph.microsoft.com/v1.0/education/classes/{educationClass-id}/assignmentDefaults will always return forbidden

3 answers

Default times assignments are due:

Add assignments to calendars:

Your answer