MS Graph returns AuthenticationError for messages endpoint

Question

MS Graph returns AuthenticationError for messages endpoint

Ivan Kirinčić 25

Hello,

We are working on an app that interacts with users emails. We have an application with Mail.ReadWrite and User.Read.All permissions. We obtained the JWT token through https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/token. After that, we call /users and get the response. When we start iterating the users and calling https://graph.microsoft.com/v1.0/users/USER_ID/messages?&count=true.Here we get the following error:
"code": "AuthenticationError",
"message": "Error authenticating with resource",

We double-checked permissions and everything is the same as on the other tenants where it works. Any tips on where and what to look for?

CarlZhao-MSFT 46,456 Reputation points

2023-10-06T10:18:06.1033333+00:00

Hi @Ivan Kirinčić

Do the users passed on all have O365 licenses?
Ivan Kirinčić 25 Reputation points

2023-10-06T11:21:56.9+00:00

Hi Carl,

The tenant that works fine has Microsoft 365 Business Standard. The one where it's not working has a Microsoft 365 Enterprise E3 license.
Domagoj Grguric 100 Reputation points

2023-10-09T14:55:48.99+00:00

Hi Carl,

to give a bit more info, Ivan and I are working on the same.

We are using the following permissions:

Files.ReadWrite.All - application

Mail.ReadWrite - application

Reports.Read.All - application

Sites.ReadWrite.All - application

User.Read - delegated

User.Read.All - application

What licenses are expected that a user has?

If needed we can provide you with the licenses list obtained through the https://graph.microsoft.com/v1.0/users/USER_ID/licenseDetails endpoint.

Thanks.
CarlZhao-MSFT 46,456 Reputation points

2023-10-10T02:16:08.9266667+00:00

Hi @Ivan Kirinčić @Domagoj Grguric

Can you provide your code snippet so I can test it in my context?

Domagoj Grguric 100

Hi Carl,

I'm providing you with a code snippet of our Python script, you can just fill in the credentials, you can use any Python version from 3.7 onward.

import requests

# FILL THIS IN:
client_id = ""
client_secret = ""
tenant_id = ""

_AUTHORITY_URL = "https://login.microsoftonline.com"
_RESOURCE = "https://graph.microsoft.com/v1.0"
_SCOPE = "https://graph.microsoft.com/.default"

data = {"client_id": client_id, "client_secret": client_secret, "scope": _SCOPE, "grant_type": "client_credentials"}
headers = {"content-type": "application/x-www-form-urlencoded"}

def authenticate(data, headers):
    url = f"{_AUTHORITY_URL}/{tenant_id}/oauth2/v2.0/token"
    response = requests.post(url=url, data=data, headers=headers)
    if response.status_code != 200:
        raise Exception(response.reason, response.text)
    return response.json()["access_token"]

def fetch_all_users(token_secret):
    headers = {"Authorization": "Bearer " + token_secret, "ConsistencyLevel": "eventual"}
    url = f"{_RESOURCE}/users"
    response = requests.get(url=url, headers=headers)
    if response.status_code != 200:
        raise Exception(response.status_code, response.reason, response.text)
    return response.json()

def fetch_messages_count_per_user(token_secret, user_id):
    headers = {"Authorization": "Bearer " + token_secret, "ConsistencyLevel": "eventual"}
    url = f"{_RESOURCE}/users/{user_id}/messages?$count=true"
    response = requests.get(url=url, headers=headers)
    if response.status_code != 200:
        raise Exception(response.status_code, response.reason, response.text)
    return response.json()["@odata.count"]

if __name__ == '__main__':
    token = authenticate(data, headers)
    users = fetch_all_users(token)

    for user in users["value"]:
        messages = fetch_messages_count_per_user(token, user["id"])
        print(f"User " + user["id"] + f" has {messages} total messages.")

Danstan Onyango 3,996 Reputation points Microsoft Employee

2023-10-11T07:15:47.71+00:00

Please provide the request id and timestamp for the API call that returns error to help find out what is wrong.

Domagoj Grguric 100

Hi Danstan & Carl,

here is the request id and the timestamp of a request that failed:

{
    "error": {
        "code": "AuthenticationError",
        "message": "Error authenticating with resource",
        "innerError": {
            "date": "2023-09-22T15:20:47",
            "request-id": "9716dd64-7e92-48c8-980b-d415e35bcb18",
            "client-request-id": "9716dd64-7e92-48c8-980b-d415e35bcb18"
        }
    }
}

If needed I can provide you with newer failed request-ids.

Thanks

Domagoj Grguric 100 Reputation points

2023-10-11T12:16:31.5233333+00:00

Accidentlly posted the same comment twice, so editing this.
Domagoj Grguric 100 Reputation points

2023-10-18T12:01:08.7533333+00:00
Hi,

quick update, after digging around we found out that the sign-in for users was not allowed:

https://stackoverflow.com/questions/67169671/powershell-getting-aadsts500014-error-while-trying-to-connect-to-exchange-onlin

When setting the sign-in to allow we started getting different errors:

{ "error": { "code": "MailboxNotEnabledForRESTAPI", "message": "The mailbox is either inactive, soft-deleted, or is hosted on-premise." } }

I can confirm that the mailbox is not hosted on-premise. Also the client confirmed that they can sign-in to their mail accounts without any issue.

When I call the https://graph.microsoft.com/v1.0/users/USER_ID/licenseDetails endpoint we get no licenses for these users.

How is it possible that the licenseDetails endpoint for these users returned no licenses at all, but they are still able to log into their mailboxes?