MS Graph does not grant access to allowExternalSenders from groups REST endpoint if application authentication is used

2
votes

I'm working on a Office 365 Groups Lifecycle tool. The app is registered with the new App V2 model and got admin consent in the related tenant. Here is the permissions info from the azure portal -> Azure AD -> Enterprise Apps List:

  • Api Name: Microsoft Graph
    • Type: Application
    • Permission: Read and write directory data
    • Granted Through: Admin consent
  • Api Name: Microsoft Graph
    • Type: Application
    • Permission: Read and write all groups
    • Granted Through: Admin consent
  • Api Name: Microsoft Graph
    • Type: Application
    • Permission: Read all users' full profiles
    • Granted Through: Admin consent

The following call URI is working as documented with Graph Explorer but not with my console application using the app id and app secret:

https://graph.microsoft.com/beta/groups/{id}/allowExternalSenders

I would also expect that the property would return in while accessing the group but the property is not part of the JSON object return.

https://graph.microsoft.com/beta/groups/{id}

Accessing the property URL returns the following error message:

Error:

response = {
  StatusCode: 403, 
  ReasonPhrase: 'Forbidden', 
  Version: 1.1, 
  Content: System.Net.Http.StreamContent, 
  Headers:
    {
      Transfer-Encoding: chunked
      request-id: a01205ec-dcc3-41cf-afc5-4943abac65aa
      client-request-id: a01205ec-dcc3-41cf-afc5-4943abac65aa
      x-...

Also, attempting to update the property is failing from the app but working from Graph Explorer (using a PATCH request).

I found some GitHub issues related the property. Due to the reporting, the documentation was updated and no longer states a PATCH request can update this property: GitHub Issue & Pull Request

I need to read and write this property. The documentation is at the moment saying this is read-only but I can read and write in Graph Explorer. I cannot however read and write via my app.

  1. What is needed to read the property? It is documented and should work right? Also as an app!

  2. When will I be able to write this property?

1
office365azure-active-directorymicrosoft-graph-api
Your question starts off with two opposing statements. You mention that you're using the v2 Endpoint but then show scopes from the Azure Portal. Apps using the v2 Endpoint (aka Converged Auth) are registered via apps.dev.microsoft.com, Apps using the v1 Endpoint are registered through the Azure Portal. Could you clarify your configuration? - Marc LaFleur
The app is registered in the V2 end point but then it needs an admin consent because I need highly privileged permissions. Even without admin consent the app will show up in the azure ad apps list if you rely on user concent. This is not an issue this is by design. It is confusing but working as documented :) - Marco Scheel
Thanks for the editing. - Marco Scheel

1 Answers

1
votes

This is a known issue:

Setting the allowExternalSenders property

There is currently an issue that prevents setting the allowExternalSenders property of a group in a POST or PATCH operation, in both /v1.0 and /beta.

There isn't an ETA for when allowExternalSenders will be supported in Microsoft Graph.