Microsoft Graph - SharePoint Web API Service v2.0 - Authorization

[TomasHarcar]

Hello,

I'm trying to utilize the Microsoft Graph - SharePoint Web API Service v2.0 VBO asset downloaded from the Digital Exchange.

Running the process according to the manual attached to the asset, I'm unable to perform any action using the Web API. Microsoft Graph is being authorized and an AccessToken is generated. With the token I'm trying to perform a simple action to Get Lists, but it terminates with following message:

Internal : Unexpected error Error during Web API HTTP Request
HTTP Status Code: 403
HTTP Response Content: {"error":{"code":"AccessDenied","message":"Either scp or roles claim need to be present in the token.","innerError":{"date":"2021-08-30T10:41:33","request-id":"c2eec5c5-9a3e-4ccb-955e-f1d323c315a4","client-request-id":"c2eec5c5-9a3e-4ccb-955e-f1d323c315a4"}}}

The application in the Azure AD has the same rights according to the PDF Manual. Please see bellow.


Are we missing some additional rights?

Thank you
Tomas Harcar

[ewilson]

There are lots of different permissions available for Microsoft Graph within Active Directory. Below is a screenshot of some of them, but there are more.


If you take a look at the Graph documentation for Sites and Lists you'll see the various permissions that are required. I see no reference, in your screenshot, to any of those Site or List permissions.


Cheers,
Eric

[TomasHarcar]

Hello Eric,

thank you for checking. I'm referencing the documentation - User Guide for the above-mentioned asset.



I was going only for the one permission displayed in the User Guide, but now seeing that there are 182 more. I will then add as many of them as possible.

Thank you
Tomas

[ewilson]

@Tomas Harcar,

I would try adding the following permissions to your Graph app registration:


If possible, I would also added them as Application permissions instead of Delegated. It just seems to make life easier. 😉

Cheers,
Eric​

[TomasHarcar]

Hi Eric,

we were able to ask for more permissions, and most likely a permission Sites.ReadWrite.All made it work.

I would say the issue is now resolved.
Thank you for your support
Tomas