Microsoft Graph API /members - returns mail: null — was working earlier

Question

We’ve integrated Microsoft Graph API to retrieve group members using this endpoint:

https://graph.microsoft.com/v1.0/groups/{group-id}/members

Previously, the API used to return user objects with mail populated. But recently, we are consistently receiving mail: null, even though no changes have been made to the app permissions. Our app is using delegated permissions:

"roles": [

"GroupMember.Read.All",

"Calendars.ReadWrite",

"Mail.Send"

]
This issue only started recently. Has Microsoft changed the behavior or tightened Graph API responses?

What permission(s) are now required to reliably receive the mail property in this call?

Thanks!

Answer 1

You need to have sufficient permissions to read the user (member) properties, as detailed for example here: https://learn.microsoft.com/en-us/graph/permissions-overview?tabs=http#limited-information-returned-for-inaccessible-member-objects

When an application queries a relationship that returns a directoryObject type collection, if it doesn't have permission to read a certain resource type, members of that type are returned but with limited information. For example, only the @odata.type property for the object type and the id is returned, while other properties are indicated as null. With this behavior, applications can request the least privileged permissions they need, rather than rely on the set of Directory.* permissions. For details, see Limited information returned for inaccessible member objects.

If the members are user objects, you need at least User.ReadBasic.All permissions. Details are in the article above.