Microsoft Graph API – Retrieving Users' Working Hours via Service Principal

Question

Hello Microsoft Team,

we use Service Principle to create events in Outlook. Now we want to extend our SP, so that we can request a working hours for users in our tenant.

The endpoint we want to use: GET /users/{id | userPrincipalName}/settings/workHoursAndLocations
But according to the official documentation, Applications are not suported in this case: https://learn.microsoft.com/en-us/graph/api/workhoursandlocationssetting-get?view=graph-rest-1.0&tabs=http#http-request

Could you please confirm, that even if our Application or SP would have the required permission MailboxSettings.Read, we still wouldn't be able to call the endpoint: GET /users/{id | userPrincipalName}/settings/workHoursAndLocations

Thank you in advance!

Best regards
Nataliia

Answer 1

Hi Nataliia,

Yes, it can be confirmed your understanding is correct.

The Microsoft Graph endpoint: GET /users/{id | userPrincipalName}/settings/workHoursAndLocations does not support Application permissions. Microsoft Graph documentation stated only delegated permissions are supported and Application permissions are explicitly listed as "Not supported" for this API. Get workHoursAndLocationsSetting - Microsoft Graph beta

Therefore, even if your Service Principal is granted: it would still not be able to call the 'workHoursAndLocations' endpoint using an application-only token. The limitation is on the API itself rather than the permission assignment.

As an alternative, if your requirement is limited to retrieving users' standard working days, working hours, and time zone before creating Outlook events, you can use: This endpoint supports the MailboxSettings.Read Application permission and can be accessed using a Service Principal.
You may refer to the following Microsoft resources: Get user mailbox settings - Microsoft Graph v1.0 | Microsoft Learn

Hope this information would be helpful.

Should you have any further questions or need additional assistance, please feel free to share them in the comment below.

---

If the answer is helpful, please click 'Yes' and kindly upvote it. If you have any extra questions about this answer, please click "Comment".  

Note: Please follow the steps in the forum documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Are there any alternatives, which we can use?

Answer 3

Yes. A service principal cannot call GET /users/{id | userPrincipalName}/settings/workHoursAndLocations.

The API supports only delegated permissions for work or school accounts. For this endpoint:

• Application permissions: Not supported
• /me requires a signed-in user and delegated permission
• /users/{id | userPrincipalName} is allowed only when the ID is the caller’s own user ID

That means granting MailboxSettings.Read to an application or service principal does not enable app-only access to this endpoint. MailboxSettings.Read is listed only under delegated permissions for this API.

The same limitation also applies to related work plan APIs such as:

• occurrencesView
• recurrences

Those also do not support application permissions.

---

References:

• Get workHoursAndLocationsSetting
• workHoursAndLocationsSetting: occurrencesView
• List recurrences
• Working with users in Microsoft Graph