Getting Unauthorized on Create ChatMessage even though Application has Teamwork.Migrate.All permission (BETA)

user_716748 0
Viewed 2087

I'm using the /beta endpoints for Microsoft Graph API, but I'm getting an Unauthorized error when trying to create chat messages on behalf of other users (or any user).

In v1.0 of the API, the Create chatMessage method is not Supported, but in Beta it is: https://docs.microsoft.com/en-us/graph/api/channel-post-message?view=graph-rest-beta&tabs=http, as "Teamwork.Migrate.All" permission, which my Application has in Azure.

It is strange, because the same App can create Teams, channels and add members, but not add channel messages.

Anyone know where to look next?

Edit: I got this back now: "You need to add user delegated permissions in your application to at least Group.ReadWrite.All in portal.azure.com and then consent as user or Grant admin consent in portal. And re-run On behalf of a User | Get User Access Token request to update access token."

However, it does not make sense in regards to what the Beta documentation says about the permission "Teamwork.Migrate.All", which my app has as an "Application Permission": "Allows the app to create chat and channel messages, without a signed in user. The app specifies which user appears as the sender, and can backdate the message to appear as if it was sent long ago. The messages can be sent to any chat or channel in the organization."

If I'm an app and I have that permission, what should I do with a User Access Token? I'm using the App Access Token.

microsoft-graph-api azure-active-directory graph api
2 Answers

For simply posting message to Teams Channel using Application Permission is not supported by Microsoft Graph

Alternatively you can setup Incoming Webhook which is connector in MsTeams's channel and after finish set up on Teams channel you will received URL which you could use Postman or any API consumer app to send request(your message) to Incoming Webhook which will be post in Teams Channel

Sample Result Image

NOTE: Incoming Webhook is not support for replying post

user_43608070

You need to add user delegated permissions in your application to at least Group.ReadWrite.All in portal.azure.com and then consent as user or Grant admin consent in portal. And re-run On behalf of a User | Get User Access Token request to update access token.

It seems that you need to use a user token instead of an application token to create chat messages. The only difference between them is that the user token requires the user to log in. The application token allows the application to create chat messages on behalf of other users. Currently, you can only use user tokens.

As your prompt message says, you need to grant the Group.ReadWrite.All delegation permission to the application, and then grant the admin consent for the permission, and then you need to use the auth code flow to obtain the access token.

enter image description here

Update:

I think what you are doing is importing messages, not creating chat messages, it does require you to have the Teamwork.Migrate.All application permission.

Importing messages is special, it requires you to create team and create achannel in the migration state, you need to include the migration value in the teamCreationMode and channelCreationMode instance attributes in the POST request. See: here.

enter image description here

enter image description here

user_133366830
Related