Microsoft Security | Microsoft Graph
An API that connects multiple Microsoft services, enabling data access and automation across platforms
Graph API call getting content of callRecording with OnlineMeetingRecording.Read.Chat returns ERROR
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(316.8, 82%, 40%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EYT%3C/text%3E%3C/svg%3E)
Yusuke Tada
0
Reputation points
Graph API returns 401 Error and error code is "UnknownError" (whole error text is written in attachment.)
- Trying to get content of callRecording and above error occurs.
https://learn.microsoft.com/en-us/graph/api/callrecording-get?view=graph-rest-1.0&tabs=python/users/{userId}/onlineMeetings/{meetingId}/recordings/{recordingId}/content - Using code is same as the sample code in documents.
from msgraph import GraphServiceClient result = await graph_client.users.by_user_id('user-id').online_meetings.by_online_meeting_id('onlineMeeting-id').recordings.by_call_recording_id('callRecording-id').get() - Using RSC of "OnlineMeetingRecording.Read.Chat" grant with the manifest.json of the teams bot, and other grants such as "ChatMember.Read.Chat" are working correctly.
- No error occurs when calling API to get metadata of callRecording
/users/{userId}/onlineMeetings/{meetingId}/recordings/{recordingId} - When using "OnlineMeetingRecording.Read.All" with same code, can get content successfully, but its grant is too strong for our service. I am supposed to use RSC grants
I assume it is either a kind of bug, or required setting is missing.
I would be grateful if you could help me. Thank you,
Microsoft Security | Microsoft Graph
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(201.6, 99%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ER%3C/text%3E%3C/svg%3E)
Rukmini 8,335 Reputation points Microsoft External Staff Moderator2025-11-17T08:10:48.3366667+00:00 Hello Yusuke Tada,
Can you please include how are you generating access token to call the API?
-
Yusuke Tada 0 Reputation points
2025-11-17T09:13:52.4166667+00:00 Hello Rukmini,
Thank you for your reply.
Below is the code to call the API.
from msgraph import GraphServiceClient from azure.identity import ClientSecretCredential credential = ClientSecretCredential( tenant_id=tenant_id, client_id=client_id, client_secret=client_secret ) graph_client = GraphServiceClient(credentials=credential, scopes=["https://graph.microsoft.com/.default"]) result = await graph_client.users.by_user_id('user-id').online_meetings.by_online_meeting_id('onlineMeeting-id').recordings.by_call_recording_id('callRecording-id').get()In my understanding, there is no need to handle access key directly when I am using msgraph on Python.
Actually, other API call works correctly except "getting content of callRecording"
I am using client_id & client_secret generated by Azure bot services.
client_id : Microsoft App ID on Azure bot service
client_secret : value of Client Secret on Azure - Certifications and Secrets
And use client_id in the manifest.json of the teams bot.
The bot is installed on the teams and as referred before, API call works correctly EXCEPT "getting content of callRecording"client_id
client_secret_id
manifest.json
The parameter "AAD_APP_CLIENT_ID" value is same as client_id
"bots": [ { "botId": "${{AAD_APP_CLIENT_ID}}", "scopes": ["team", "personal", "groupChat"], "isNotificationOnly": false, "supportsCalling": true, "supportsVideo": true, "supportsFiles": true } ],"webApplicationInfo": { "id": "${{AAD_APP_CLIENT_ID}}", "resource": "https://RscBasedStoreApp" }, -
Rukmini 8,335 Reputation points Microsoft External Staff Moderator
2025-11-17T09:24:32.08+00:00 Yusuke Tada, Could you please provide the screenshot of API permissions blade?
-
Yusuke Tada 0 Reputation points
2025-11-17T09:32:12.9433333+00:00 In addition, I found "request-id" and "client-request-id" in the error message I attached on the 1st post.
"request-id": "b5c68f0e-a45f-4d1e-9f57-49b3a336dba8" "client-request-id": "b5c68f0e-a45f-4d1e-9f57-49b3a336dba8"I am glad if it could be of any assistance.
Excerpt from an error message below:
{ "error": { "code": "UnknownError", "message":"\r\n<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Strict//EN\"\r\n\"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd\">\r\n<html... [Omitted] "innerError": { "date": "2025-11-17T00:35:58", "request-id": "b5c68f0e-a45f-4d1e-9f57-49b3a336dba8", "client-request-id": "b5c68f0e-a45f-4d1e-9f57-49b3a336dba8" } } } -
Rukmini 8,335 Reputation points Microsoft External Staff Moderator
2025-11-17T09:35:01.7333333+00:00 Yusuke Tada, Could you please provide the screenshot of API permissions blade?
-
Yusuke Tada 0 Reputation points
2025-11-17T09:45:01.18+00:00 Thank you for your quick response!
I put screenshots of the permissions on both Azure and Teams.
In my understanding, RSC permissions are shown on Teams, and I can see "OnlineMeetingRecording.Read.Chat" on the Admin console of Teams.
Permission on Azure
Permission on Teams
-
Rukmini 8,335 Reputation points Microsoft External Staff Moderator
2025-11-17T09:48:32.71+00:00 Yusuke Tada, The error is because you have granted delegated API permissions and using ClientSecretCredential flow to generate access token.
To resolve the error, you need to grant OnlineMeetingRecording.Read.All, application type API permission in the Microsoft Entra ID application too.
-
Yusuke Tada 0 Reputation points
2025-11-17T10:06:21.4833333+00:00 Thank you for suggestion, Rukmini
However, I think it is not possible to grant OnlineMeetingRecording.Read.Chat in the Microsoft Entra ID, because It is one of RFC permissions, so I can only find "OnlineMeetingRecording.All" but not "OnlineMeetingRecording.Chat".
As I preferred before, "OnlineMeetingRecording.Read.All" is too strong permission for our service. I am supposed to use RSC grants.
Please teach me if there is any way to grant OnlineMeetingRecording.Read.Chat in the Microsoft Entra ID in Azure console.
-
Rukmini 8,335 Reputation points Microsoft External Staff Moderator
2025-11-17T10:08:43.9466667+00:00 Yusuke Tada, To resolve the error you need to grant OnlineMeetingRecording.Read.All in the Microsoft Entra ID application.
-
Yusuke Tada 0 Reputation points
2025-11-17T10:18:51.0033333+00:00 Thank you Rukmini.
Please teach me how to do it.
Do you mean I can grant OnlineMeetingRecording.Read.Chat in the console page as the screenshot of below ?
-
Rukmini 8,335 Reputation points Microsoft External Staff Moderator
2025-11-17T10:23:46.24+00:00 Yusuke Tada To resolve the error you need to grant OnlineMeetingRecording.Read.All, in the Microsoft Entra ID application not OnlineMeetingRecording.Read.Chat.
-
Yusuke Tada 0 Reputation points
2025-11-17T10:25:12.29+00:00 After I hit "Adding permissions", I could not find "OnlineMeetingRecording.Read.Chat" in the list of permissions
-
Rukmini 8,335 Reputation points Microsoft External Staff Moderator
2025-11-17T10:27:52.31+00:00 Yusuke Tada OnlineMeetingRecording.Read.All API permission not OnlineMeetingRecording.Read.Chat
-
Yusuke Tada 0 Reputation points
2025-11-17T10:28:49.5566667+00:00 I see, I know I can do it using OnlineMeetingRecording.Read.All
However, it is too strong grant for our service.
As I written, am supposed to use RSC grants if I can.
In the document, it looks possible to use OnlineMeetingRecording.Read.Chat to get content of MeetingRecord.
https://learn.microsoft.com/en-us/graph/api/callrecording-get?view=graph-rest-1.0&tabs=python
Is it the document is wrong?
-
Rukmini 8,335 Reputation points Microsoft External Staff Moderator
2025-11-17T15:11:02.1033333+00:00 Yusuke Tada I will check and get back to you
-
Yusuke Tada 0 Reputation points
2025-11-17T20:37:56.1866667+00:00 I really appreciate your efforts.
I look forward to your response.
-
Yusuke Tada 0 Reputation points
2025-11-19T00:51:06.1333333+00:00 Rukmini
Are you still looking into this?
If you have any updates, I’d appreciate it if you could share them. -
Yusuke Tada 0 Reputation points
2025-11-21T07:18:05.8666667+00:00 Rukmini
Are there any updates on the investigation?Even just a quick confirmation that the investigation is still ongoing would be greatly appreciated.
-
Yusuke Tada 0 Reputation points
2025-11-25T02:42:09.3133333+00:00 Rukmini
Is this investigation still ongoing?
The result of this problem has a significant impact on our business, so we would greatly appreciate it if it is not left unattended. -
Yusuke Tada 0 Reputation points
2025-12-03T01:14:38.0433333+00:00 I solved the problem by myself. -
Yusuke Tada 0 Reputation points
2025-12-03T04:59:38.97+00:00 Sorry, It's not solved yet.
"OnlineMeetingRecording.Read.Chat" is not enough to resolve the problem
Sign in to comment
Sign in to answer