Cannot get photo of a guest user using Graph API

Question

Hello,

I get following error when I want to get the photo of a guest user in Azure AD B2B with the following API endpoint.

https://graph.microsoft.com/v1.0/me/photo/$value

{ "error": { "code": "UnknownError", "message": "{\"error\":{\"code\":\"NoPermissionsInAccessToken\",\"message\":\"The token contains no permissions, or permissions can not be understood.\",\"innerError\":{\"oAuthEventOperationId\":\"d1451a47-99dc-4520-9843-c25acd96983e\",\"oAuthEventcV\":\"sgkZYEAJdECPUS7GIdvSaQ.1.1\",\"errorUrl\":\"https://aka.ms/autherrors#error-InvalidGrant\",\"requestId\":\"ead1dead-7dd7-42f4-8d5d-90efe84e0258\",\"date\":\"2021-03-15T17:33:56\"}}}", "innerError": { "date": "2021-03-15T17:33:57", "request-id": "ead1dead-7dd7-42f4-8d5d-90efe84e0258", "client-request-id": "ead1dead-7dd7-42f4-8d5d-90efe84e0258" } } }  

I have also given app permissions as below.

I get the same error in Postman and when calling the above endpoint from my front-end application which is hosted as an app service.

Please note that we have 2 subscriptions. I can use Graph Explorer for the default subscription and get the photo. But I want to use the other subscription (directory) in the application. However this gives above error.

Please also note that I could get profile info, see attached groups and add members to groups via Graph API. It seems only photo is not working.

Please let me know if you need more information.

Answer 1

So these are the steps I followed on Postman using the Microsoft Graph collection and I am able to get the profile photo:

1. ensure you have set up Microsoft Graph collection on your postman. Please refer to this short video on how to do so if you haven't yet.
2. open a new tab on Postman and add a GET request as https://graph.microsoft.com/v1.0/me/photo/$value then click on the save button.
3. on the 'save request' dialog box, save the new request under the 'OnBehalf of a User' in the Microsoft Graph collection
4. go to the Authorization tab and click on the 'On Behalf of a User'
5. Click on 'Get New Access Token' then login as a user then click on 'Proceed' after which, click on 'Use token'
6. The dialog box will close then click on send and you should get the profile photo.

Give this a try and let me know how it goes