Search code examples
azureauthenticationazure-active-directorymicrosoft-graph-apiazure-ad-msal

https://graph.microsoft.com/v1.0/me returns 403 for other users than myself

I have developed a small app using the Express MSAL tutorial as the authentication mechanism.

I can log in and request my user info through https://graph.microsoft.com/v1.0/me just fine.

However, if I switch to a test user (in the same domain) I get a 403 error when accessing https://graph.microsoft.com/v1.0/me. Also confirmed this is happening to a colleague (also in the same domain)

Using jwt.ms, I can see that the access token I get for my own user has scp: openid profile User.Read email while my test user only gets scp: openid profile email. So I guess, it is working as intended. But, the question is - how do I add User.Read to all users using the app?

In the API permissions for my app in the Azure portal, I have Delegated User.Read as a permission. (I think this was added automatically) API permissions

Solution

  • I tried to reproduce the same in my environment and got the same error as below:

    enter image description here

    The error usually occurs if the user doesn't have the required permissions to perform the action:

    enter image description here

    To resolve the error, try the below:

    I agree with DipeshJadhav, Generate the token with scope as https://graph.microsoft.com/.default :

    enter image description here

    The access token contains the user.read permission when decoded like below:

    enter image description here

    After passing the correct scope, I am able to read the user details successfully:

    enter image description here

    In your code try passing the scope as: scopes: ["https://graph.microsoft.com/.default"]

    If still the issue persists, grant Admin consent to the API permission:

    enter image description here