i have a file on onedrive that is labeled and encrypted with microsoft information protection sdk. i'm trying to replace this encrypted file with another one (encrypted or non-encrypted) and getting 403 forbidden. this is the api i'm using: put /users/{user-id}/drive/items/{item-id}/content note that when replacing a non-encrypted file the api works perfectly fine. i tried inspecting the token on jwt.ms and these are the permissions i have: "sites.selected", "mail.readwrite", "user.readwrite.all", "domain.readwrite.all", "calendars.read", "people.read.all", "directory.readwrite.all", "sites.read.all", "sites.readwrite.all", "sites.manage.all", "files.readwrite.all", "directory.read.all", "user.read.all", "informationprotectioncontent.write.all", "files.read.all", "mail.read", "directory.write.restricted", "calendars.readwrite", "informationprotectionpolicy.read.all", "contacts.read", "informationprotectioncontent.sign.all", "sites.fullcontrol.all" can't figure why i'm getting th

using a token generated from a fresh partner center refresh token. my user is ga of partner tenants. process is still working fine for /beta/policy/ hits. it did work for /beta/reports at one stage a couple of weeks ago however i have been pulling my hair out since getting nothing but 403's. returned scopes with tenant token: email https://graph.microsoft.com/.default https://graph.microsoft.com/policy.read.all https://graph.microsoft.com/policy.read.conditionalaccess https://graph.microsoft.com/reports.read.all openid profile new to graph api, if you could point me to more information (perhaps where to find information from the azure side) that would be appreciated.

i login graph explorer with admin user to try list teams channel messages https://graph.microsoft.com/v1.0/teams/{team-id}/channels/{channel-id}/messages but when i list a private channel (admin user is not member) or private teams (admin user is not member) messages will get 403 forbidden. is only member can list private team or private channel messages?

i am trying to access plan data using user credentials. below is my code, which returns access token. however when i try and get the planner information from this url using httpclient. i keep getting 403 error. https://graph.microsoft.com/v1.0/groups/group-id/planner/plans public static async task getaccesstoken(string resourceid, string username, string password) { try { var authority = "https://login.windows.net/common/oauth2/authorize/"; var authcontext = new authenticationcontext(authority); var credentials = new userpasswordcredential(username, password); var authresult = await authcontext.acquiretokenasync(resourceid, , credentials); // get the result return authresult.accesstoken; } catch (exception ex) { // todo: handle the exception return string.empty; } } what am i doing wrong ?

hi, i am trying to create a meeting using https://graph.microsoft.com/v1.0/me/onlinemeetings. but i got 403 forbidden an error has occurred. i also tried to decode the token a found the scope user.readwrite. here are my attached screenshots

view=graph-rest-beta&tabs=http#permissions deserialized token we used for authentication: { "aud": "https://graph.microsoft.com", "iss": "https://sts.windows.net/xxx/", "iat": 1655160900, "nbf": 1655160900, "exp": 1655247600, "aio": "xxx", "app_displayname": "xxx", "appid": "xxx", "appidacr": "2", "idp": "https://sts.windows.net/xxx/", "idtyp": "app", "oid": "xxx", "rh": "xxx", "roles": [ "sites.manage.all", "sites.readwrite.all", "files.readwrite.all" ], "sub": "xxx", "tenant_region_scope": "eu", "tid": "xxx", "uti": "xxx", "ver": "1.0", "wids": [ "xxx" ], "xms_tcdt": "1509395911" } however, we receive a 403 response with the content: { "error": { "code": "accessdenied", "message": "cannot call this api using the current app id

hi, i created 30 day free trial account on office 365 and then i registered app on azure portal. i'm testing creating new shifts by ms graph api by executing endpoint: https://graph.microsoft.com/v1.0/teams/{teamid}/schedule/shifts unfortunately i receive error 403 like below in response: { "error": { "code": "forbidden", "message": "{\"error\":{\"code\":\"forbidden\",\"message\":\"sorry, you need to be an admin to do this.

i'm trying to use microsoft graph api with postman. i've thus followed step by step what is described here: https://docs.microsoft.com/en-us/graph/use-postman i'm blocked at the "set up application api calls" step 5: "select update. close the manage environments dialog box. in the microsoftgraph | application collection on left side, choose get app-only access token. then choose send on the right." i have granted all the permissions in aad: - directory.readwrite.all - user.readwrite.all but i still have the same 403 error when executing get https://graph.microsoft.com/v1.0/users "insufficient privileges to complete the operation." please someone help with this?

i am trying out the beta endpoint to get teams meeting information but i am constantly getting a 403 forbidden. as you can see below the application has the correct graph permissions the token i acquire also contains this in the roles: an example of a request: https://graph.microsoft.com/beta/users//onlinemeetings/ this always returns a 403 forbidden. in the application, if i query a user or a group it works with no issue. i'm hoping i'm missing something obvious so would appreciate any guidance here.

hey, when i connect to graph and want to read my own onedrive data with "https://graph.microsoft.com/v1.0/me/drive/root/children" everything works fine. when i try to do this for another user with "https://graph.microsoft.com/v1.0/users('f5774033-e2fd-4ae4-8e11-123456789')/drive/root/children" i get a 403 error. the user in particular has an e3 license. as far as i can estimate, i do have the correct rights: does anyone see what i'm doing wrong?

good day i'm implemeting the createonlinemeetings under https://graph.microsoft.com/v1.0/users/[userid]/onlinemeetings endpoint. my application already have adminconsent, but i'm receiving the 403 forbidden result can someone assist me?

when calling this endpoint: https://graph.microsoft.com/beta/informationprotection/policy/labels the call succeeds as expected when invoked in postman, returns a response: { "@odata.context": "https://graph.microsoft.com/beta/$metadata#informationprotection/policy/labels", "value": [ { ... } ] } however, using the exact same headers and access token when making a request in python yields as part of the response: "message":"\r\n<b>403</b> forbidden\r\n\r\n 403 forbidden\r\nmicrosoft-azure-application-gateway/v2\r\n\r\n\r\n" the permission "https://graph.microsoft.com/informationprotectionpolicy.read.all" has been granted. is there some other setting within the application that needs to be changed to allow the request to go through?

hi, i have created a application on azure ad. with a sample daemon-application i've got the users list. i'm trying to get access to users calendar but getting 401 with message: unauthorized or 403 with message: forbidden api url: 1. https://graph.microsoft.com/v1.0/me/calendars 2. https://graph.microsoft.com/v1.0/me/events?

we are using an api with the graph api to monitor teams chat messages for inappropriate language and blocking messages. this is all working great for chats and teams channels in our tenancy, and for chats we initiate to external tenancies. however, if an external tenancy initiates a chat to us, the api receives the message okay, but when we call the patch route on /chats it fails with a 403 even on messages our users type in the chat.. i am guessing that the chat itself is hosted in the external tenancy and therefore my client application does not have permission to patch it, however given the message still appears to one of my users i want to be able to block it if it fails our policy.

using get https://graph.microsoft.com/v1.0/sites/{site-id}/lists/{list-id} in microsoft graph explorer to read powerapps list, but i a getting 403 error. however, i can read the same list using the same user in visual studio console project with csom.