13,721 questions
Need help with API scope permissions configuration
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(19.2, 52%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ER%3C/text%3E%3C/svg%3E)
radoslavov
1
Reputation point
Hi all, i'm having a Azure app registration connected to graph API. I have all Graph API endpoint permission configured (I'm using application permission instead of delegated as there are some restrictions if using delegated permissions).
I'm using this application in Power Automate inside a custom connector to create Microsoft Teams upon the user's request. When I start the Flow I receive the following error message:
Missing scope permissions on the request. API requires one of 'Team.Create, Group.ReadWrite.All, Directory.ReadWrite.All'. Scopes on the request '.5a3ef3d3-c5d8-49ea-9787-9d621eb31257'
The permissions mentioned in the error message are added to the API permission of Graph, so I'm guessing I'm missing something else, I probably need to add them in another place, but until now I've been using only delegated permissions, so I've never had this error before.
Microsoft Security Microsoft Graph
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(224.00000000000003, 8%, 31%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESM%3C/text%3E%3C/svg%3E)
Sheena-MSFT 1,736 Reputation points2022-09-05T14:34:32.873+00:00 Could you please decode the access token using jwt.io and check the roles?
-
radoslavov 1 Reputation point
2022-09-06T11:33:11.627+00:00 Hi Sheena, never done this before, any instructions how/where?
-
Sheena-MSFT 1,736 Reputation points
2022-09-06T12:19:41.537+00:00 Copy your access token paste in this link . Check roles in the right side and share the screenshot.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(121.6, 7.000000000000001%, 21%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMS%3C/text%3E%3C/svg%3E)
Mehtab Siddique (MINDTREE LIMITED) 971 Reputation points2022-09-09T04:58:18.263+00:00 Hi @radoslavov , any update on the issue?
-
radoslavov 1 Reputation point
2022-09-14T10:42:23.317+00:00 Apologies for the late response, i pasted the code in jwt.io but I don't see any roles
-
radoslavov 1 Reputation point
2022-09-14T10:54:29.827+00:00 That is a bit strange, as you can see from the picture in the post, I've added all required permission in the API permissions section and they all have granted access and admin consent, but in the token, they seem not to appear.
-
Mehtab Siddique (MINDTREE LIMITED) 971 Reputation points
2022-09-20T06:43:56.003+00:00 Hi @radoslavov , Can you please share the API query and the error details like client request id and the timestamp of it, Thanks.
-
radoslavov 1 Reputation point
2022-09-23T12:45:01.607+00:00 This is the error message i get from Power Automate when executing Create Team action
{
"error": {
"code": "Forbidden",
"message": "Missing scope permissions on the request. API requires one of 'Team.Create, Group.ReadWrite.All, Directory.ReadWrite.All'. Scopes on the request '.5a3ef3d3-c5d8-49ea-9787-9d621eb31257'",
"innerError": {
"date": "2022-08-29T11:26:03",
"request-id": "04cc661e-5e72-48bb-8be4-02540ba82794",
"client-request-id": "04cc661e-5e72-48bb-8be4-02540ba82794"
}
}
}
-
Mehtab Siddique (MINDTREE LIMITED) 971 Reputation points
2022-12-14T12:19:54.443+00:00 I checked the process from my side and i was able create Microsoft Teams upon the user's request, no issue from my side, sorry for delayed resoponse
Sign in to comment
Sign in to answer