Search code examples
azuremicrosoft-graph-apimicrosoft-teamsaccess-tokenmicrosoft-graph-teams

MS Graph - team create API returns 403 Forbidden error suddenly

I have a singletenant Azure app and i have all the required permission for creating a MS team via app, and The API was working fine with multi-tenant App earlier, but same code is not working for singletenant app registered user; Please let me know if I am missing anything here; I am using organization tenant uri in my authn and authz calls for single tenant.

Below Postman screenshot is the error response from graph API Error repsonse complete error response

API Permissions for MS Team create API

decoded token with required permission

Not able to create team since last 3 days.

Authentication

obo API

Solution

  • I registered one single tenant Azure AD application and granted Team.Create permission of Delegated type:

    enter image description here

    Now, I generated access token using on-behalf of flow via Postman with below parameters:

    POST https://login.microsoftonline.com/tenantId/oauth2/v2.0/token

client_id:appId
client_secret:secret
scope: https://graph.microsoft.com/.default
grant_type: urn:ietf:params:oauth:grant-type:jwt-bearer
assertion: token
requested_token_use:on_behalf_of

    Response:

    enter image description here

    When I used this token to create team, I too got same error as you like below:

    POST https://graph.microsoft.com/v1.0/teams

{
  "[email protected]": "https://graph.microsoft.com/v1.0/teamsTemplates('standard')",
  "displayName": "My Sample Team",
  "description": "My Sample Team’s Description"
}

    Response:

    enter image description here

    Note: While creating teams, Microsoft 365 group will be created with same name.

    In my case, the error occurred as creation of Microsoft 365 groups is disabled for users in that specific tenant:

    enter image description here

    To resolve the error, you need to enable creation of Microsoft 365 groups option for users like this:

    enter image description here

    When I ran the graph query again by generating new token, I got below response:

    POST https://graph.microsoft.com/v1.0/teams

{
  "[email protected]": "https://graph.microsoft.com/v1.0/teamsTemplates('standard')",
  "displayName": "My Sample Team",
  "description": "My Sample Team’s Description"
}

    Response:

    enter image description here

    To confirm that, I checked the same in Portal where new Microsoft 365 group with same name created successfully:

    enter image description here