Issue with graph API call “provision email” in private channel

Sharda Patel 5

Description : We are having issue with graph API call which was working fine till week back. We provided required consent but still getting following issue (“Forbidden”). Please see the screen shot below for more details. Method : POST

https://graph.microsoft.com/v1.0/teams/cfbe625b-7ae4-47cc-95f0-d80e034aa4e3/channels/19:c56bca3a30a7495eb1853d5c29b11311@thread.tacv2/provisionEmail

{
    "error": {
        "code": "Forbidden",
        "message": "Forbidden",
        "innerError": {
            "code": "Forbidden",
            "date": "2024-01-30T18:37:58",
            "request-id": "290103ce-86ba-40a3-9f0f-0753f55f1c30",
            "client-request-id": "ba59f6c1-39eb-6542-87d0-29070525763a"
        }
    }
}

Rezwanur Rahman 1 Reputation point MVP

2024-01-30T20:53:51.6766667+00:00
Hello Sharda,

Thank you for informing about the issue. To resolve the "Forbidden" error in your Microsoft Graph API call, try the following steps:

Ensure the account making the API call has the correct permissions like ChannelMessage.Send or Group.ReadWrite.All.

Confirm in the Azure portal that admin consent is granted for the necessary permissions.

Make sure the token used includes the required scopes.

Look for any changes in code, app registration, or Azure AD policies since the issue started.

You can use the Graph Explorer to test your query with different permissions to see if it works there. https://developer.microsoft.com/en-us/graph/graph-explorer

Just let me know if you already checked everything or not. I will be happy to help you here :)

Regards

Rezwanur Rahman
Microsoft MVP - Microsoft Graph Development
JimmyYang-MSFT 51,716 Reputation points Microsoft Vendor

2024-01-31T02:36:39.3666667+00:00

@Sharda Patel Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.

1 answer

CarlZhao-MSFT 41,126 Reputation points

2024-01-31T02:53:56.48+00:00
Hi @Sharda Patel

You need to meet the following:

Make sure you have assigned the ChannelSettings.ReadWrite.All delegate permission to the calling app and granted administrator consent.

Make sure you are requesting the access token using a delegated authentication flow, such as auth code flow or ROPC flow (not recommended).

Make sure the logged in user is a member or owner of the team. If the logged in user is not a member or owner of the team, then make sure the user has the Group Admin/Team Admin/Global Admin role.

Make sure the logged in user has an Office 365 license.

Hope this helps.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.
Please sign in to rate this answer.
Sharda Patel 5 Reputation points

2024-01-31T06:58:42.6966667+00:00

I have followed the instructions.

Assigned the permission and delated to user and admin consent done at AD App.

var scopes = new[] { "ChannelSettings.ReadWrite.All", "ChannelMessage.Send","Group.ReadWrite.All", "AllSites.FullControl", "Sites.Search.All", "TermStore.ReadWrite.All", "User.Read", "profile", "openid", "email" };

Also tried the c# client which gives same error. var gsc = GetGraphServiceClientByUserCredential(); var channels = await graphServiceClient.Teams[TeamGUID].Channels.GetAsync((requestConfiguration) => { requestConfiguration.QueryParameters.Filter = "displayName eq 'XXXXXX'"; requestConfiguration.Headers.Add("Prefer", "allowthrottleablequeries"); }); if (channels != null && channels.Value != null && channels.Value.Count == 1) { await gsc.Teams[TeamGUID].Channels[channels.Value[0].Id].ProvisionEmail.PostAsync(); } public GraphServiceClient GetGraphServiceClientByUserCredential() { var scopes = new[] { "ChannelSettings.ReadWrite.All", "ChannelMessage.Send","Group.ReadWrite.All", "AllSites.FullControl", "Sites.Search.All", "TermStore.ReadWrite.All", "User.Read", "profile", "openid", "email" }; var clientId = Environment.GetEnvironmentVariable("ClientID"); var tenantId = Environment.GetEnvironmentVariable("TenantId"); var userName = "user name 1"; var password = "***"; var options = new UsernamePasswordCredentialOptions { AuthorityHost = AzureAuthorityHosts.AzurePublicCloud, }; var userNamePasswordCredential = new UsernamePasswordCredential( userName, password, tenantId, clientId, options); return new GraphServiceClient(userNamePasswordCredential, scopes); }

Sharda Patel 5 Reputation points

2024-01-31T07:05:08.6433333+00:00

User is owner of Team and Private Channel

Also tried with Global admin

same code was working week back

Please suggest what else we can try . same is not working inn Graph explorer and getting same error.

{ "error": { "code": "Forbidden", "message": "Forbidden", "innerError": { "code": "Forbidden", "date": "2024-01-30T18:37:58", "request-id": "290103ce-86ba-40a3-9f0f-0753f55f1c30", "client-request-id": "ba59f6c1-39eb-6542-87d0-29070525763a" } } }

CarlZhao-MSFT 41,126 Reputation points

2024-01-31T08:07:18.19+00:00

Does the logged in user have a valid Office 365 license?

Sharda Patel 5 Reputation points

2024-01-31T08:14:41.27+00:00

Yes, account has Office 365 E3. Further investigating in different tenant with fresh AD APP settings. will let you know

Sharda Patel 5 Reputation points

2024-02-02T05:55:15.1366667+00:00

For updates , this issue automatically fixed without any change. seems this was may be internal issue at Microsoft graph API.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Issue with graph API call “provision email” in private channel

1 answer

Your answer