'Unauthorized' error when requesting '/joinedTeams' from Microsoft Graph

问题

I am setting up an app for modifying a Microsoft Teams account (teams/channels) through the Microsoft Graph API, but I can't get responses from all of the endpoints which I need to call. I have followed the guide for creating an app with application permissions and acquired access (and refresh) token(s) succesfully.

Calling the https://graph.microsoft.com/v1.0/users/<user guid>/joinedTeams endpoint yields a response as follows:

{
  "error": {
    "code": "Unauthorized",
    "message": "Unauthorized",
    "innerError": {
      "date": "2020-06-24T12:37:53",
      "request-id": <guid>
    }
  }
}

while calling endpoints such as https://graph.microsoft.com/v1.0/users works as described. It would seem that the app hasn't gotten consent and/or permissions to access these, but after signup they are listed on the API permissions in the azure portal enterprise applications page, and the access token JWT contains the specified permissions as a roles object.

From the JWT:

"roles": [
    "TeamSettings.ReadWrite.All",
    "User.ReadWrite.All",
    "Directory.ReadWrite.All",
    "Group.ReadWrite.All",
    "TeamMember.ReadWrite.All",
    "Team.ReadBasic.All",
    "GroupMember.ReadWrite.All",
    "Member.Read.Hidden"
  ]

I have tried with the Directory.ReadWrite.All permission and also with the full permission list listed on the permissions page for the /joinedTeams endpoint and they all elicit the same error.

Curiously, according to this a 401 - Unauthorized response would be given for expired (or similarly invalid) tokens, however that seems to clearly not be the case as I can call other endpoints with that very token.

What am I missing?

回答1:

Solved thanks to @MikeOliver When I signed up for Teams it created another directory. Only that second directory had a Teams "license" (visible from the azure portal's License page).

来源：https://stackoverflow.com/questions/62555955/unauthorized-error-when-requesting-joinedteams-from-microsoft-graph