CODEWITHSUNDEEP
azureauthenticationmicrosoft-graph-apioffice365microsoft-graph-calendar
Josep Navarro
Josep Navarro

Reputation: 3

Error: "OrganizationFromTenantGuidNotFound" (even with Microsoft 365 subscription)

I'm trying to get the events from outlook calendar but I get an error doing so. I have an app registered on Azure Portal (free plan), which I'm using to read the events with Nodejs. This are the permissions I've set in order to be able to query the Microsoft Graph API:
ApiPermissions

Using https://login.microsoftonline.com/{tenantId}/oauth2/authorize?client_id={clientId}&response_type=code&redirect_uri=http://localhost:3000&scope=https://graph.microsoft.com/.default openid profile offline_access&state=12345 I've been able to get a {code} which I'm using to redeem an access token using https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token with this body parameters:

{
    "grant_type": "authorization_code",
    "code": "{code}",
    "redirect_uri": "http://localhost:3000",
    "client_id": "{clientId}",
    "client_secret": "{clientSecret}",
    "scope": "https://graph.microsoft.com/.default openid profile offline_access"
}

I believe that the scope of this token is also suitable for what I need:
TokenError

When I try to make a request to https://graph.microsoft.com/v1.0/{tenantId}/users or even https://graph.microsoft.com/v1.0/997f56e7-06b6-44ad-be6a-3cc7377ae54a/users/{userId}, I get the users data without problems. The response looks like this:

{
    "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#users/$entity",
    "businessPhones": [],
    "displayName": "My Display Name",
    "givenName": "My Name",
    "jobTitle": null,
    "mail": null,
    "mobilePhone": null,
    "officeLocation": null,
    "preferredLanguage": "en",
    "surname": "My Surname",
    "userPrincipalName": "[email protected]",
    "id": "aaaaaaaa-bbbb-cccc-..."
}

But when I make a request to https://graph.microsoft.com/v1.0/{tenantId}/users/{userId}/calendars I get the following error:

{"error":{"code":"OrganizationFromTenantGuidNotFound","message":"The tenant for tenant guid '\[tenantGuid\]' does not exist.","innerError":{"oAuthEventOperationId":"bf9e026f-6160-4975-8952-1796d0903882","oAuthEventcV":"tiG/jGvOvqjHEw5i0jde2Q.1","errorUrl":"https://aka.ms/autherrors#error-InvalidTenant%22,%22requestId%22:%22b274ff09-22e7-48ff-abfa-1703c90ad358%22,%22date%22:%222023-03-28T07:42:17"}}}

I followed this documentation.

Also, I did an extensive search about this error and I found that I needed a Microsoft 365 subscription, so I bought one. I currently have the Microsoft 365 personal plan.

And I added the Office 365 Management APIs permissions on Azure Portal.

I still have the same issue, do I need to set up the tenant again? Do I need to change something in the configuration or am I missing something? Maybe I don't have the right subscription, do I need a Microsoft 365 Business subscription? How can I solve it?

What's interesting is that when I try to make the exact same requests using the Microsoft Graph Explorer it works as expected. And if I use the token given there in Access token tab in my backend it works as well, so I believe the problem is with the token I'm getting.

Upvotes: 0

Views: 3872

Answers (2)

shakir ullah
shakir ullah

Reputation: 367

Problem: I encountered the error organizationfromtenantguidnotfound while trying to authenticate users with their Outlook accounts using Azure AD. The error indicated that the tenant GUID provided did not exist.

Solution: To resolve this issue, I replaced the tenant ID with the keyword common in the authorizationURL and tokenURL. This allows users from any Azure AD tenant, including personal Microsoft accounts, to authenticate.

{
  clientID: this.configService.get<string>('AZURE_CLIENT_ID'),
  clientSecret: this.configService.get<string>('AZURE_CLIENT_SECRET'),
  callbackURL: this.configService.get<string>('AZURE_CALLBACK_URL'),
  authorizationURL: 'https://login.microsoftonline.com/common/oauth2/v2.0/authorize',
  tokenURL: 'https://login.microsoftonline.com/common/oauth2/v2.0/token',
  scope: [
    'openid',
    'User.Read',
    'profile',
    'email',
    'Mail.Read',
    'Mail.ReadBasic',
  ],
}

Upvotes: -2

Rukmini
Rukmini

Reputation: 16074

I created an Azure AD Application and granted API permissions like below:

enter image description here

I generated auth code by using below endpoint:

https://login.microsoftonline.com/TenantID/oauth2/v2.0/authorize?
&client_id=ClientID
&response_type=code
&redirect_uri=https://jwt.ms
&response_mode=query
&scope=https://graph.microsoft.com/.default
&state=12345

enter image description here

I generated access token by using below parameters:

https://login.microsoftonline.com/TenantID/oauth2/v2.0/token

client_id:ClientID
grant_type:authorization_code
scope:https://graph.microsoft.com/.default
code:code
redirect_uri:https://jwt.ms
client_secret:ClientSecret

enter image description here

When I decoded the token, scopes are present:

enter image description here

Using the above generated access token, I am able to fetch the calendar details successfully like below:

https://graph.microsoft.com/v1.0/{tenantId}/users/{userId}/calendars

enter image description here

The error usually occurs if the license is missing in your tenant to perform the action.

To resolve the error, subscribe O365 license and assign O365 license to the users like below:

enter image description here

If still the issue persists, check the below:

  • Check whether you are passing correct TenantID.
  • Make use of organizations/common endpoint if you are calling other tenant users.
  • Otherwise, try configuring another tenant and check.

Upvotes: 1

Related Questions