Failed to list recordings, code invalidAudienceUri

Question

facing error while fetching webinar recording
error Failed to list recordings: {"error":{"code":"unauthenticated","innerError":{"code":"invalidAudienceUri"},"message":"Invalid audience Uri 'XXXXXXX3-XXXX-XXX1-XX00-XXXXXXXXXXXX'."}}

my code having this
$response = Http::withToken($token) ->get("https://graph.microsoft.com/v1.0/users/{$organizerUserId}/drive/root:/Recordings:/children");

unless i logged in i am not able to fetch recording, how can i handle this because i am not run fetch recording manually there are a cron job to fetch recording.

i am using same id for both UAT and PROD, the UAT webinar fetch recording working properly in other side the PROD fetch recording functionality throws an error mention in the starting

Answer 1

unless i logged in i am not able to fetch recording, I have compare both UAT and PROD tokens, both are identical it contains
aud: [https://graph.microsoft.com](https://graph.microsoft.com) and Files.Read.All / OnlineMeetings.Read.All

i am using same account and same MS entra app for teams webinar for both UAT and PROD

Answer 2

Hi @Team Talgro

The error appears to be related to the access token used for the Microsoft Graph request rather than the cron job itself.

Your request requires $token to be a valid Microsoft Graph access token. The invalidAudienceUri error typically indicates that the token was issued for a different resource and its audience (aud) does not match Microsoft Graph.

Since the same organizerUserId works in UAT but fails in PROD, I would recommend comparing the token acquisition and configuration in both environments.

In particular, please decode the PROD access token and check the aud claim. You can decode access tokens using https://jwt.ms

This link is shared by community members for your convenience. It points to a third-party site that is not managed or verified by Microsoft. I can’t guarantee the quality, safety, or suitability of any content or software found there. Please review carefully and make sure you understand any potential risks before using it. 

For Microsoft Graph, it should be https://graph.microsoft.com or 00000003-0000-0000-c000-000000000000

Reference: Troubleshoot Access Token Signature Validation Errors | Microsoft Learn

Since this process runs through a cron job, it should not depend on an interactive user sign-in. Instead, the recommended approach is to use an application-only access token obtained through the client credentials flow with the appropriate Microsoft Graph application permissions and admin consent.

Please verify the following in the PROD environment:

• The Tenant ID, Client ID, and Client Secret used to acquire the token.
• The scope used when requesting the token (for Microsoft Graph this is typically https://graph.microsoft.com/.default).
• The aud claim in the generated token.
• Whether the required Microsoft Graph application permissions have been granted and admin consented.
• Whether PROD is using an application token or a delegated token intended for another API.

Also, could you please test the Microsoft Graph request directly in Postman to determine whether the issue is related to the access token?

In Postman, create a POST request:

POST https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token

Go to Body > x-www-form-urlencoded and enter:

grant_type    client_credentials
client_id     {your-client-id}
client_secret {your-client-secret}
scope         https://graph.microsoft.com/.default

Send the request.

After obtaining the access token, add it to the Authorization tab in Postman as a Bearer Token, then use the token to test the endpoint.