Graph Api issue trying to update contact to outlook global address list in an organisation

Question

 def __init__(self, tenant_id, client_id, client_secret):
        self.tenant_id = tenant_id
        self.client_id = client_id
        self.client_secret = client_secret
        self.contacts_endpoint_base = 'https://graph.microsoft.com/v1.0/me/contacts'
        self.credential = ClientSecretCredential(
            tenant_id=self.tenant_id,
            client_id=self.client_id,
            client_secret=self.client_secret
        )
        self.token_response = self.credential.get_token("https://graph.microsoft.com/.default")
        self.headers = {
            'Authorization': f'Bearer {self.token_response.token}',
            'Content-Type': 'application/json'
        }
        self.initialize_csv()
        logging.info("ContactManager initialized successfully")

Note: I tried to use endpoint /contacts and also /users to update no luck

Logs:

2024-06-04 15:00:38,164 - INFO - ClientSecretCredential.get_token succeeded

2024-06-04 15:00:38,167 - INFO - ContactManager initialized successfully

2024-06-04 15:00:38,176 - DEBUG - Starting new HTTPS connection (1): graph.microsoft.com:443

2024-06-04 15:00:38,865 - DEBUG - https://graph.microsoft.com:443 "GET /v1.0/me/contacts?$filter=mail%20eq%20%27asdadaredsdasadw%example.com%27 HTTP/1.1" 400 None

2024-06-04 15:00:38,865 - ERROR - Failed to retrieve contacts: 400 Client Error: Bad Request for url: https://graph.microsoft.com/v1.0/me/contacts?$filter=mail%20eq%20%27asdadaredsdasad%4example.com%27

2024-06-04 15:00:38,869 - ERROR - Failed to search contacts: 400 Client Error: Bad Request for url: https://graph.microsoft.com/v1.0/me/contacts?$filter=mail%20eq%20%27asdadaredsdasadw%exmaple.com%27

Answer 1

Hi @Pavan Goud

The access /me/contacts endpoint does not support the use of the client credential flow, which requires user participation to access, and the client credential flow does not have user participation, so please use auth code flow to access on behalf of the user, and use the delegation permissions Contacts.Read or Contacts.ReadWrite.

Refer to the code below.

scopes = ['User.Read']
# Multi-tenant apps can use "common",
# single-tenant apps must use the tenant ID from the Azure portal
tenant_id = 'common'
# Values from app registration
client_id = 'YOUR_CLIENT_ID'
client_secret = 'YOUR_CLIENT_SECRET'
redirect_uri = 'YOUR_REDIRECT_URI'
# For authorization code flow, the user signs into the Microsoft
# identity platform, and the browser is redirected back to your app
# with an authorization code in the query parameters
authorization_code = 'AUTH_CODE_FROM_REDIRECT'
# azure.identity.aio
credential = AuthorizationCodeCredential(
    tenant_id=tenant_id,
    client_id=client_id,
    authorization_code=authorization_code,
    redirect_uri=redirect_uri,
    client_secret=client_secret)
graph_client = GraphServiceClient(credential, scopes) # type: ignore

More details can be found at this link:
https://learn.microsoft.com/en-us/graph/sdks/choose-authentication-providers?tabs=python#authorization-code-provider

Hope this helps.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.