Subscribe to Microsoft Office 365 Management Activity API: Authorization denied

0
votes

I try to subscribe to Office 365 Management API and fail.

posting to https://manage.office.com/api/v1.0/{tennant-id}/activity/feed/sub scriptions/start?contentType=Audit.SharePoint Returns with the following error:

<Response [401]> {"Message":"Authorization has been denied for this request."}

When using local python environment. I already have access Token, which I use it to print the office 365 root website and connect to Azure Active Directory. I suspected the error was in the way I created the Microsoft azure web app, therefore I created a new azure web-app which ended with the same result, also when I creating “Native Client app” ended with the same result. When I use an 'web app python console', for exampl 'pythonanywhere', an exception is being thron, with the following error: “Cannot connect to proxy. Socket error: Tunnel connection failed: 403 Forbidden.”

I followed Microsoft Manual: https://msdn.microsoft.com/en-us/library/office/mt227394.aspx#StartSubscription

Sample of my code:

tid = {my tenant ID}
subscriptionHeader = { 'Content-Type': 'application/json; utf-8' , 'Authorization': 'Bearer %s' % (access_token)}
subscriptionBody = {"webhook" : {
       "address": {my site} } }
subscribtionPostUrl = "https*://manage.office.com/api/v1.0/%s/activity/feed/subscriptions/start?contentType=Audit.SharePoint" %(tid)
print ("posting to %s\n" % (subscribtionPostUrl) )
subscribtionPost = requests.post(subscribtionPostUrl, data=subscriptionBody, headers=subscriptionHeader)
print ("subscribtionPost %s\n" % (subscribtionPost ) )
print ("subscribtionPost %s\n" % (subscribtionPost.text ) )
2
pythonazurepython-requestsjwtoffice365api

2 Answers

4
votes

I had the same problem and the solution was to use https://manage.office.com as a resource when you ask for the token (and NOT https://manage.office.com/ - note the forward slash at the end, you should not include it...)

0
votes

According your error message:

{"Message":"Authorization has been denied for this request."}

It seems your Azure AD application doesn't have enough permission for this operation. You can try to run following powershell script to upgrade your AD application's permission:

#use the administrator account to sign in 
Connect-MsolService
$ClientIdWebApp = '{your_AD_application_client_id}'
$webApp = Get-MsolServicePrincipal –AppPrincipalId $ClientIdWebApp
#use Add-MsolRoleMember to add it to “Company Administrator” role).
Add-MsolRoleMember -RoleName "Company Administrator" -RoleMemberType ServicePrincipal -RoleMemberObjectId $webApp.ObjectId

And meanwhile, every access_token will expire in 3600 seconds, and during my test, I will reproduce your issue only when my access_token has expired.