azuremicrosoft-graph-api

Using Microsoft Graph Explorer (we have code too) we can GET All Subscriptions, but GET one by ID gives access error

I have been trying to write code to delete a subscription and it doesn't throw an exception, but when I look in Graph Explorer I see the subscription is still there. So to try and figure out why it doesn't work in my Java code, I decided to try it all out in Graph Explorer as it would tell me more information. And it does.

Here are screenshots showing the ability to run GET api to get all subscriptions, then I copy the first UUID and try just a GET to get that one specific subscription and it fails with a 403 Access Denied. I looked at the tab for permissions, and the App granted permissions and the documentation on Microsoft and the correct permissions are granted.

What am I missing?

GET all Subscriptions call

Call to GET the one subscription

ApiConnectors permissions granted

Subscription permission granted

Showing that user has Mail.Read permission

Administrator roles

Solution

  • As always it is about the correct permissions. The documentation does not show all the permissions required. It was required to add the .Shared versions as well.

    Got it to finally work by adding the .Shared consent. so not only Mail.Read and Mail.ReadBasic, but also Mail.Read.Shared and Mail.ReadBasic.Shared is required.