获取计划返回 401 - 未经授权

Question

I am new to Microsoft Graph. I wanted to create a console app which will fetch all the Group Ids based on a Group Name and then fetch a particular Plan Id with that Group Id and Plan Name (I may or may not be a member of that group).

I have written a code which is able to fetch group Id but when I try to use it to fetch the Plan Id:

var targetGroup = await _graphClient
    .Groups
    .Request()
    .Filter($"startsWith(displayName,'{groupName}')")
    .GetAsync();

var groupId = targetGroup.First().Id;

var plans = await _graphClient
    .Groups[groupId]
    .Planner
    .Plans
    .Request()
    .GetAsync();

This last line fires an exception:

401 - Unauthorized: Access is denied due to invalid credentials.

I am using the O365 E3 Trial version. I have read all the solutions posted here and tried them but the error is still there. I have allowed all the permissions (Delegated and Application) for Users, Tasks, Directory, Files, and Groups.

Could it be a problem with permissions or the trail version?

Update:

I also tried this:

GraphHttpClient.MicrosoftGraphV1BaseUri + $"groups/{groupId}/planner/plans";

It works fine for groupId but when I add /planner/plans it throws the same exception.

Answer 1

Are you using User access token or Application token? Because that api (GET /groups/{group-id}/planner/plans) it's not supported for Application token according to documentation . I'm not sure for User access token but I think you must be a member of the group to reach out to plans.

Answer 2

The sample code you've refferenced is using the Client Credentials OAuth grant. This will result in assigning Application scopes to your token rather than Delegate scopes:

AuthenticationResult authResult = null;
authResult = await _clientApplication
    .AcquireTokenForClient(_scopes) // This is "Client Credentials"
    .ExecuteAsync();
return authResult.AccessToken;

Specifically, the AcquireTokenForClient call is where this is happening. From the documentation :

Acquires a token from the authority configured in the app, for the confidential client itself (in the name of no user) using the client credentials flow. See https://aka.ms/msal-net-client-credentials .

As Martin Jones stated in his answer, /plans only supports Delegated permission scopes :

• Delegated (work or school account): Group.Read.All , Group.ReadWrite.All
• Delegated (personal Microsoft account): Not supported .
• Application: Not supported .

In order to call /plans , you will need to acquire a token using a different OAuth Grant which supports Delegated permissions such as AcquireTokenOnBehalfOf or AcquireTokenByAuthorizationCode .