Incorrect Permissions when GET https://graph.microsoft.com/beta/education/classes/<ClassId>/members

Question

I am trying to get a list of members of a class in MS Graph Education.

I make this call:

https://graph.microsoft.com/beta/education/classes//members

But I get this error:

 {:code=>"AccessDenied", :message=>"Required claim values are not provided." }

My application is configured to use the following scopes: EduAssignments.Read.All EduRoster.Read.All

I can successfully get classes, assignments, even the teachers. https://graph.microsoft.com/beta/education/classes/ https://graph.microsoft.com/beta/education/classes//assignments https://graph.microsoft.com/beta/education/classes//teacher

But somehow it fails for: https://graph.microsoft.com/beta/education/classes//members

What am I missing?

Answer 1

I just tried the API and it works. What I see different in your case are the permissions. Refer to the API documentation for details on what permissions are allowed- https://docs.microsoft.com/en-us/graph/api/educationclass-list-members?view=graph-rest-1.0&tabs=http

e.g. for delegate permission type you need EduRoster.ReadBasic, and for application permission type you need EduRoster.Read.All, EduRoster.ReadWrite.All plus Member.Read.Hidden. In my case I was querying for members in a class where I am a teacher and I am querying with delegate EduRoster.ReadBasic permission. I do see all members in the class.