CODEWITHSUNDEEP
azure-active-directorymicrosoft-graph-teams
frcnav10
frcnav10

Reputation: 13

Not able to add certain Graph API Permissions

I am currently developing a service that would be able to sync data between workforce management systems (like Kronos WFC) and Microsoft Shifts. In order to sync the data, I have to register a Workforce Integration. I have established the necessary permissions, but I am not able to add permissions and I'm returned a message on the Azure Portal that permissions are not supported. The tenant that I'm using for development has also been whitelisted. Ideally whitelisting should be solving all problems when it comes to adding Graph API scopes, but in this instance, the whitelisting does not seem to resolve. Any ideas as to why such thing is happening?Screenshot from demo tenant

Upvotes: 0

Views: 210

Answers (2)

Zacharious
Zacharious

Reputation: 555

Some Graph permissions are not allowed on applications that support Microsoft accounts authentication (e.g. Skype, Xbox, Hotmail). The WorkforceIntegration permissions are one of them.

The idea is that some O365 enterprise services are not available to consumer Microsoft accounts. Unfortunately I don't know where these permissions are documented but please comment if you find the list.

Upvotes: 1

Jack Jia
Jack Jia

Reputation: 5549

Sometimes, it could be a temporary error. You may have another try at a later time.

Please do not add too many permissions at one time. I tried to add that permission and got a success:

enter image description here

By the way, as Azure AD V2 supports to grant permission dynamically. You may directly add and grant permission to a new scope.

Note: I just want to show you the detailed flow, but in fact all the following steps can be done with ADAL or MSAL.

For example:

I did not have https://graph.microsoft.com/Chat.ReadWrite permission at first. But I can request that permission dynamically through Azure AD OAuth2 authorization code flow:

A. Make a request call to

https://login.microsoftonline.com/<your_tenent_id_or_name,hanxia.onmicrosoft.com>/oauth2/v2.0/authorize?response_type=code
&client_id=88b1****-***-****-****-f64c****9f8a
&redirect_uri=https://localhost/
&scope=https://graph.microsoft.com/Chat.ReadWrite

B. Grant the permission

enter image description here

C. Check the permissions in Enterprise Application enter image description here

You can see that a new permission was added. And then uses in the tenant can use that permission scope.

Upvotes: 0

Related Questions