Getting "AuthenticationError" from Microsoft when retrieving photo in Graph

Question

I am querying Microsoft Graph with App-Only permissions since I'm acting on all users in the directory. When I make the query for the onPremisesSamAccountName with my token, I have no issues. However, when I attempt to retrieve the photo for the user (using the same token), I get the following:

StatusCode: 400 Bad Request
Error Code: AuthenticationError
Error Message: Error authenticating with resource

I have the following app-only permissions assigned in my tenant:

User.Read.All (application, admin consented)
Directory.Read.All (application, admin consented)

Details:

URI: https://graph.microsoft.com/v1.0/users/[email protected]/photo/$value
Scope: https://graph.microsoft.com/.default
Content-type: application/json
Authorization header: "bearer _my token string_"

Here is my request (in ColdFusion):

<cfhttp method="get" charset="utf-8" url="https://graph.microsoft.com/v1.0/users/[email protected]/photo/$value" result="resp">
    <cfhttpparam type="header" name="Content-Type" value="application/json">
    <cfhttpparam type="header" name="Authorization" value="bearer Oxfd989309sdf...">
</cfhttp>

The response I get back is what I showed above. When I run my token through http://jwt.calebb.net/, I don't see any scopes set.

I tried running this through Graph Explorer. I signed in as myself, then I ran the URI https://graph.microsoft.com/v1.0/me/photo, the response I received was:

{
    "error": {
        "code": "ErrorItemNotFound",
        "message": "The photo wasn't found.",
        "innerError": {
            "request-id": "ebae50f8-b636-4e61-9d92-eab4b48ef0c2",
            "date": "2019-08-08T19:13:50"
        }
    }
}

I would expect that because I don't have a photo.

When I use the URI https://graph.microsoft.com/v1.0/users/[email protected]/photo/$value, I get the following response:

{
    "error": {
        "code": "ResourceNotFound",
        "message": "Resource could not be discovered.",
        "innerError": {
            "request-id": "40246947-57d6-4016-a55a-c1ad5f0736e4",
            "date": "2019-08-08T19:16:37"
        }
    }
}

I patterned my request after the documentation where it shows a sample GET

GET /users/{id | userPrincipalName}/photo/$value

Did I miss a step, or leave out a scope?

Does the user you're testing with have an Exchange Online mailbox provisioned, with a profile picture uploaded? — Marc LaFleur
@MarcLaFleur, no the user does not have a provisioned mailbox with photo. I knew I would get an error of some sort, but I wasn't expecting an authentication error. I also saw that my roles [directory.read.all, users.read.all] were present. So, the particular AuthenticationError I received, is that indicative of a lack of Exchange Online license? — BashfulCoder
I think @Marc has answered your question, you can accept it as the answer. — Tony Ju

Tony Ju Tony Ju · Accepted Answer · 2019-08-09T01:50:22

When I run my token through http://jwt.calebb.net/, I don't see any scopes set.

When you get the token by using client credentials flow, you will get the permissions under roles.

I tried running this through Graph Explorer. I signed in as myself, then I ran the URI https://graph.microsoft.com/v1.0/me/photo, the response I received was:404

Just like @Marc LaFleur said in the comment, make sure the user has an Exchange Online mailbox provisioned, with a profile picture uploaded.

Getting "AuthenticationError" from Microsoft when retrieving photo in Graph

2 Answers