SP Online - "getOffice365GroupsActivityDetail" Graph API call fails under the SPFx

[zorayr]

Category

• Bug

Describe the bug

The MS Graph REST API call getOffice365GroupsActivityDetail fails with status "403 - S2SUnauthorized" under the SPFx using MSGraphClient.

Steps to reproduce

All screenshots are provided below in Additional context section.

1. Create an SPFx web part project
2. Add Reports.All.Read Delegated permission, approve it (see screenshots 1 and 2)
3. Use MSGraphClient for MS Graph API calls and this method .api("/reports/getOffice365GroupsActivityDetail(period='D180')").get(...
4. Use Tenant Admin with enough permissions (see the screenshot 3)
5. Run the project, do the call
6. It fails with status code 403 - Forbidden, with error code S2SUnauthorized and error message Invalid Permission. (see screenshots 4 and 5)

Expected behavior

Expected behavior is to retrieve the report data, as all requirements are met according to the documentation.

Environment details (development & target environment)

• Developer Environment: Windows 10
• Target Environment: SharePoint Online
• Framework: .NET Framework v3.x
• Browser(s): Chrome v79
• Tooling: VS Code

Additional context

Here are some screenshots mentioned above:
Screenshot 1:

Screenshot 2:

Screenshot 3:

Screenshot 4:

Screenshot 5:

Here is the bearer token used during the call:

eyJ0eXAiOiJKV1QiLCJub25jZSI6Inc3alZUWTNZTUtQRE5jVWpFaVZKU0s5N3RWYU5xd1lKYXlGanJ3ZnR1b2siLCJhbGciOiJSUzI1NiIsIng1dCI6IkN0VHVoTUptRDVNN0RMZHpEMnYyeDNRS1NSWSIsImtpZCI6IkN0VHVoTUptRDVNN0RMZHpEMnYyeDNRS1NSWSJ9.eyJhdWQiOiJodHRwczovL2dyYXBoLm1pY3Jvc29mdC5jb20iLCJpc3MiOiJodHRwczovL3N0cy53aW5kb3dzLm5ldC82MDRhYzcyMi0xYTBmLTRkNDMtYmIzOC03ZWU0YWEzMTBmMzIvIiwiaWF0IjoxNTkxMDgyNjQ2LCJuYmYiOjE1OTEwODI2NDYsImV4cCI6MTU5MTA4NjU0NiwiYWNjdCI6MCwiYWNyIjoiMSIsImFpbyI6IkFTUUEyLzhQQUFBQWcwbzduZVhBMmtCVDVjM2c1L2hlOGg4anNOK25uNWk3Yk8ybzhNWUcvcDQ9IiwiYW1yIjpbInB3ZCJdLCJhcHBfZGlzcGxheW5hbWUiOiJTaGFyZVBvaW50IE9ubGluZSBDbGllbnQgRXh0ZW5zaWJpbGl0eSBXZWIgQXBwbGljYXRpb24gUHJpbmNpcGFsIiwiYXBwaWQiOiJhOTZjYmQxMC1lOTYwLTQ3YjgtODU1Yi0zYWY0YjVkYmQ2ZjQiLCJhcHBpZGFjciI6IjAiLCJmYW1pbHlfbmFtZSI6IlRvb2xzIiwiZ2l2ZW5fbmFtZSI6IkxpZ2h0bmluZyIsImlwYWRkciI6IjE0MS4xMzYuODIuMTgwIiwibmFtZSI6IkxpZ2h0bmluZyBUb29scyBBZG1pbiIsIm9pZCI6IjhmMjhhMDk1LWJlYmMtNDMxMS04YzFmLTg5YTVhNDRhNDMyOCIsInBsYXRmIjoiMyIsInB1aWQiOiIxMDAzQkZGRDk3QUI5MTAzIiwic2NwIjoiQ29udGFjdHMuUmVhZCBEaXJlY3RvcnkuUmVhZC5BbGwgRGlyZWN0b3J5LlJlYWRXcml0ZS5BbGwgRmlsZXMuUmVhZC5BbGwgR3JvdXAuUmVhZC5BbGwgTWFpbC5SZWFkIFJlcG9ydHMuUmVhZC5BbGwgU2l0ZXMuUmVhZC5BbGwgVXNlci5SZWFkIiwic2lnbmluX3N0YXRlIjpbImttc2kiXSwic3ViIjoidHRSQ19zMk9LemRUM2FMTUR1MWZrZ3F5VTd6Z1NscTJCclluQUZnRElmSSIsInRlbmFudF9yZWdpb25fc2NvcGUiOiJFVSIsInRpZCI6IjYwNGFjNzIyLTFhMGYtNGQ0My1iYjM4LTdlZTRhYTMxMGYzMiIsInVuaXF1ZV9uYW1lIjoibHRhZG1pbkBMaWdodG5pbmdUb29sc0Rldi5vbm1pY3Jvc29mdC5jb20iLCJ1cG4iOiJsdGFkbWluQExpZ2h0bmluZ1Rvb2xzRGV2Lm9ubWljcm9zb2Z0LmNvbSIsInV0aSI6InhpRUQyNU9KdTA2akpONGRpNFVYQUEiLCJ2ZXIiOiIxLjAiLCJ4bXNfdGNkdCI6MTQ2Mjg3MzM5OX0.rJSVzDVbMA6sja6I3MXD8RgZI4rzqQD3QRmaLWVNEw7Q9U1mXt8KyCSIKCufUlPPeC6nW2pJsTTpzJjYxCEmO_NUMAW3rfvpV7aHrVTdJ1GGHns_Q7ZvrBeNFRJ25asMH7mTBSTDP0x1p_0TON5ewg9TlVmUlXSKvpd-5Y3nKftbLEOvTHCFThhHZBYDkAW6Xz3sJlXcviX9lomC8TpG5iNsRBm6wkljaUrZx_2RScmzaZ_n7l1OjaWPY4sIyKeyc1j7VzMGJ6eTn-p4pbipRiSYb4AWXxl81guZKoI0nlHkEJCvHxmst4IxhObwMwHLBKeba6uImdKUSTuF_glu_A

As we can see from the parsing, the token includes required permission to read the report.
Screenshot 6:

Thanks a lot !

[msft-github-bot]

Thank you for reporting this issue. We will be triaging your incoming issue as soon as possible.

[BrianTJackett]

I am able to reproduce the behavior experienced using Postman with an implicit authentication access token which is what I believe MSGraphClient also uses. Decoding the access token it appears the "wids" claim which lists which Azure AD roles are assigned to the delegated user are not included when using implicit authentication. See below.

Microsoft identity platform access tokens - payload claims

wids	Array of RoleTemplateID GUIDs	Denotes the tenant-wide roles assigned to this user, from the section of roles present in the admin roles page. This claim is configured on a per-application basis, through the groupMembershipClaims property of the application manifest. Setting it to "All" or "DirectoryRole" is required. May not be present in tokens obtained through the implicit flow due to token length concerns.

[patmill]

parsing through this bug and the linked issues, it seems like this can be closed. If that wasn't the case, feel free to reopen.

Issues that have been closed & had no follow-up activity for at least 7 days are automatically locked. Please refer to our wiki for more details, including how to remediate this action if you feel this was done prematurely or in error: Issue List: Our approach to locked issues