How to resolve 401 for Graph API https://graph.microsoft.com/v1.0/me/todo/lists

Question

How to resolve 401 for Graph API https://graph.microsoft.com/v1.0/me/todo/lists

Simon B 20

Hey,

I've created an application which works with OAuth Authentication flow to run Graph apis delegated on behalf of the user. My Authoirzation flow works fine with the user having to consent the required permission,
Access Token which I get has the following scope:

profile
openid
email
https://graph.microsoft.com/Calendars.Read
https://graph.microsoft.com/Tasks.ReadWrite
https://graph.microsoft.com/User.Read

the resulting access token works fine for https://graph.microsoft.com/v1.0/me

but https://graph.microsoft.com/v1.0/me/todo/lists always fails with 401 Unauthorized.
Application is configured for:
grafik

I've decoded the token via jwt.ms but cannot find any issue with it.

{ "typ": "JWT",
 "nonce": "XVUwjH0MSe12pi7yLVR_XT50eYDGQQPqw8CKdxbHans",
 "alg": "RS256",
 "x5t": "KQ2tAcrE7lBaVVGBmc5FobgdJo4",
 "kid": "KQ2tAcrE7lBaVVGBmc5FobgdJo4" 
}
"aud": "https://graph.microsoft.com",
"iss": "https://sts.windows.net/[MY_TENANT_ID]/",
"iat": 1722989537,
"nbf": 1722989537,
"exp": 1722993572,
"acct": 0,
"acr": "1",
"aio": "AYQAe/8XAAAAqL0ZLuX29inDvlpA5Gwd9S3t+1U8LK0DH6c3MFaiytkjUMBb95pBER8i9jUpNi/HKFeW7psDiv9PkutLpYNrXJmQvAgYKzLAjh29JbgbG/NMlBCAUKS+F/ORQyi6u8kfggAj7MnI3nT9e/dcH39LZRfdtjaTsLoRsmL7IVxXm2Q=",
"altsecid": "1:live.com:0003BFFDD309A7AF",
"amr": [ "pwd", "mfa" ],
"app_displayname": "Eat Sleep Repeat",
"appid": "[MY_APP_ID]",
"appidacr": "1", 
"email": "******@googlemail.com",
"family_name": "xxxxx",
"given_name": "Simon",
"idp": "live.com",
"idtyp": "user",
"ipaddr": "[MY_IP_ADDRESS]",
"name": "XXXX", 
"oid": "[MY_OID]", 
"platf": "3",
"puid": "10032003AF6B0F67",
"rh": "0.ARMB13e5fCHNfUq1g9n5l97n0gMAAAAAAAAAwAAAAAAAAAATAYE.",
"scp": "Calendars.Read Tasks.ReadWrite User.Read profile openid email",
"signin_state": [ "kmsi" ],
"sub": "4bVb9RrEzFMI5yUkUo873H8GP9Y1RNfv1PZMEthJNig",
"tenant_region_scope": "EU",
"tid": "[MY_TENANT_ID]",
"unique_name": "XXXXXXX",
"uti": "G3voec9KR0yUuwYDqj0OAA",
"ver": "1.0",
"wids": [ "62e90394-69f5-4237-9190-012177145e10", "b79fbf4d-3ef9-4689-8143-76b194e85509" ], "xms_idrel": "1 24",
"xms_st": { "sub": "_qTiJ_riOzuRMGojxVOvgKv5IVdDtJETm63nMN78S_s" },
"xms_tcdt": 1722785256,
"xms_tdbr": "EU" }

Manifest of my application:


{
	"id": "[ID]",
	"acceptMappedClaims": null,
	"accessTokenAcceptedVersion": null,
	"addIns": [],
	"allowPublicClient": null,
	"appId": "[Application (client) ID]",
	"appRoles": [],
	"oauth2AllowUrlPathMatching": false,
	"createdDateTime": "2024-08-04T21:51:20Z",
	"description": null,
	"certification": null,
	"disabledByMicrosoftStatus": null,
	"groupMembershipClaims": null,
	"identifierUris": [],
	"informationalUrls": {
		"termsOfService": null,
		"support": null,
		"privacy": null,
		"marketing": null
	},
	"keyCredentials": [],
	"knownClientApplications": [],
	"logoUrl": "https://aadcdn.msftauthimages.net/c1c6b6c8-mvt0wqms4gutfewngm7iwquwopp5hf8diwmd1xl1t0g/appbranding/x4xuygxt5ixtbooirhp85ogkwo0ub5ocgzndd-8spdo/1033/bannerlogo?ts=638584071799305155",
	"logoutUrl": null,
	"name": "Eat Sleep Repeat",
	"notes": null,
	"oauth2AllowIdTokenImplicitFlow": false,
	"oauth2AllowImplicitFlow": false,
	"oauth2Permissions": [],
	"oauth2RequirePostResponse": false,
	"optionalClaims": null,
	"orgRestrictions": [],
	"parentalControlSettings": {
		"countriesBlockedForMinors": [],
		"legalAgeGroupRule": "Allow"
	},
	"passwordCredentials": [
		{
			"customKeyIdentifier": null,
			"endDate": "2025-02-01T23:56:48.646Z",
			"keyId": "[KEY_ID]",
			"startDate": "2024-08-05T22:56:48.646Z",
			"value": null,
			"createdOn": "2024-08-05T22:56:50.4459586Z",
			"hint": "mU0",
			"displayName": "DFLT_CRED2"
		},
		{
			"customKeyIdentifier": null,
			"endDate": "2025-02-01T23:54:02.239Z",
			"keyId": "[KEY_ID]",
			"startDate": "2024-08-05T22:54:02.239Z",
			"value": null,
			"createdOn": "2024-08-05T22:54:06.1710153Z",
			"hint": "5_h",
			"displayName": "DFLT_CRED"
		}
	],
	"preAuthorizedApplications": [],
	"publisherDomain": "[MY_DOMAIN]",
	"replyUrlsWithType": [
		{
			"url": "[MY_URL]/get-token",
			"type": "Web"
		}
	],
	"requiredResourceAccess": [
		{
			"resourceAppId": "00000003-0000-0000-c000-000000000000",
			"resourceAccess": [
				{
					"id": "465a38f9-76ea-45b9-9f34-9e8b0d4b0b42",
					"type": "Scope"
				},
				{
					"id": "7427e0e9-2fba-42fe-b0c0-848c9e6a8182",
					"type": "Scope"
				},
				{
					"id": "2219042f-cab5-40cc-b0d2-16b1540b4c5f",
					"type": "Scope"
				},
				{
					"id": "e1fe6dd8-ba31-4d61-89e7-88639da4683d",
					"type": "Scope"
				}
			]
		}
	],
	"samlMetadataUrl": null,
	"signInUrl": null,
	"signInAudience": "AzureADMyOrg",
	"tags": [],
	"tokenEncryptionKeyId": null
}

What do I need to change to get https://graph.microsoft.com/v1.0/me/todo/lists to work? - Thanks!

Answer accepted by question author

4 additional answers

Your answer

Answer 1

Anonymous

@Simon B Thank you for sharing the solution.

Question:

When a personal account accesses the Graph API using auth code flow, the correct permissions are granted, and access to the /me endpoint is normal, but access to /me/todo/lists always fails without 401 authentication.

Solution:

Switched supported account types to personal accounts only: grafik

made sure that all calls are no longer going for my Directory (tenant) ID but rather against the consumers tenant. So e.g.

https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize

https://login.microsoftonline.com/consumers/oauth2/v2.0/token

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Answer 2

Anonymous

Hi @Simon B

Your parsed token looks fine, but there is still 401 error, please check whether the token is invalid or has expired, generally, the validity period of the token is 1 hour, after the expiration, use the refresh token to obtain a new token and try again.

You can also try testing it in Graph Explorer first. After testing, grant the Tasks.Read permission to your application, and you can list task lists normally.

Reference documents are as follows:

https://learn.microsoft.com/en-us/graph/resolve-auth-errors#401-unauthorized-error-is-your-token-valid

Hope this helps.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.

Simon B 20 Reputation points

2024-08-07T19:45:14.7333333+00:00
Thanks for your response.
I've tried the suggested steps but unfortunately without any success.

Maybe I'm getting something mixed up, therefore here are the exact calls I'm making:

Getting an Authorization Code [as described in https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow#request-an-authorization-code]:
https://login.microsoftonline.com/[MY_TENANT_CODE]/oauth2/v2.0/authorize?client_id=[MY_CLIENTID]&scope=https%3A%2F%2Fgraph.microsoft.com%2F.default%20offline_access&response_type=code&prompt=consent&redirect_uri=[MY_REDIRECT_URI]&response_mode=query
--> User gets prompted to consent the required scopes defined in my App
--> offline_access is there so I can store a refresh_token for this user for further requests in the future.
--> User is redirected to my App. I get the Code parameter from the URL to use it to get the first access token as follows.

2.POST-Request to https://login.microsoftonline.com/[MY_TENANT_CODE]/oauth2/v2.0/token with request body [as described in https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow#request-an-authorization-code]:
client_id=[MY_CLIENT_ID]&client_secret=[MY_CLIENT_SECRET]&scope=https://graph.microsoft.com/.default&offline_access&code=[MY_INITIAL_CODE_FROM_STEP_1]&redirect_uri=[MY_REDIRECT_URI]&grant_type=authorization_code
(here I've also tried to have the URL Parameters in scope escaped, either way same result)
--> Parsing the response and storing access token + access token expiration time in a session variable + Storing the refresh token in my User table
--> Utilizing the acquired access token for another request by setting it as request Header Authorization Key Bearer [MY_NEW_ACCESS_TOKEN]

GET-Request to https://graph.microsoft.com/v1.0/me
--> Parsing request to also store userPrincipalName in my User table
--> the request works with the access token acquired from 2.

GET-Request to https://graph.microsoft.com/v1.0/me/todo/lists
again with request Header Authorization Key Bearer [MY_NEW_ACCESS_TOKEN] (here I've also tried to get a new access token inbetween with the stored refresh token, but same result either way)
-->Result-Status-Code: 401
-->Result-Response: {"error":{"code":"UnknownError","message":"","innerError":{"date":"2024-08-07T19:23:53","request-id":"cd90cda1-1f3b-4437-966f-9709b4b89a3e","client-request-id":"cd90cda1-1f3b-4437-966f-9709b4b89a3e"}}}
(here I've validated, that the access token is not expired yet)
Anonymous

2024-08-08T08:12:36.32+00:00

Does your account have a valid MS 365 License, as shown below:
Simon B 20 Reputation points

2024-08-08T18:26:01.05+00:00

within entra.microsoft.com it does not show any licenses. The user I'm trying it with has a Microsoft 365 Family license assigned. Are there licensing requirements to utilize tasks api?
Simon B 20 Reputation points

2024-08-08T18:30:45.9233333+00:00

so basically users have a license on their Microsoft personal accounts

based on this I would have expected that delegated access works for personal Microsoft accounts?
Anonymous

2024-08-09T09:02:36.5233333+00:00

After testing, personal accounts are supported, please test in Graph Explorer to further troubleshoot your problem.
Simon B 20 Reputation points

2024-08-09T23:27:54.14+00:00

@Anonymous
thanks for your help, got it resolved now. I've posted the solution as a seperate answer
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Answer 3

Simon B 20

I've got it resolved for my use case.

Switched supported account types to personal accounts only:
grafik

made sure that all calls are no longer going for my Directory (tenant) ID but rather against the consumers tenant. So e.g.
https://login.microsoftonline.com/consumers/oauth2/v2.0/authorize

https://login.microsoftonline.com/consumers/oauth2/v2.0/token

Anonymous

2024-08-12T02:57:44.1833333+00:00

Thank you for your answer, please click "Accept Answer", which may help members with similar questions find the answer easily. Thank you very much!
Simon B 20 Reputation points

2024-08-12T05:46:03.0766667+00:00

@Anonymous unfortunately it only allows me to select answers from others user as "Accept Answer"
Maybe you can edit yours and reference this so I can select yours as the answer
Anonymous

2024-08-12T08:24:59.58+00:00

Thank you very much, I will post a new answer and quote your content.
Anonymous

2024-08-14T06:29:54.49+00:00

Hi @Simon B

I've quoted your answer and posted a new one, please click "Accept Answer", which may help members with similar questions find the answer easily. Thank you very much!
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Answer 4

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more

Answer 5

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more

Share via

How to resolve 401 for Graph API https://graph.microsoft.com/v1.0/me/todo/lists

4 additional answers

Your answer