Microsoft graph api: Some users get a 403 when using my app, others don't, why?

Question

Problem

I get

Microsoft\Graph\Exception\GraphException: [0]: Received 403 for call to https://graph.microsoft.com/beta/me/chats/[id]@unq.gbl.spaces/members

I fail to understand why.

Research

permissions in Azure

how the exception appears in my queue

Additional information

Just to be clear: this same request with other users of our company is working, so it's not something that always fails. It might be worth noting that the permissions starting with Chat are from the beta version of the graph api. Also retrieving info about the user (ownUser getGivenName) is working for all users.

App scopes

The scopes defined in the application are:

openid profile offline_access user.read mailboxsettings.read calendars.readwrite Chat.ReadBasic Chat.Read Chat.ReadWrite

Response of the server

The response completely:

{
    "error": {
        "code": "Forbidden",
        "message": "Forbidden",
        "innerError": {
            "date": "2021-05-04T12:05:41",
            "request-id": "xxxxxxx-f7ea-4912-a23b-676002d0912d",
            "client-request-id": "xxxxxxx-f7ea-4912-a23b-676002d0912d"
        }
    }
}

The response headers also don't reveal anything:

Also tried

I also tried re-visiting https://login.microsoftonline.com/common/adminconsent?client_id=[id] and give my (admin) consent, however this doesn't change anything.

JWT token

Also I decoded both a working users jwt token and a non-working one and they have the same scp (scopes) configured. Here is the diff

used endpoints

/me/chats
/me
/me/chats/$chatId/messages
/me/chats/$chatId/members

user_2754599 · Answer

Just some observations and workarounds to help out others who come on this post through google:

Only the /me/chats/$chatId/members fails, without an apparant reason. It might be a mistake in in the beta implementation. Maybe it's better to use the $expand argument to see them to mitigate this problem.
for another subgroup of users retrieving all the chats with the endpoint /me/chats with the php sdk also fails with the recommended code

  public function listChats(): array
    {
        $graph = $this->getGraph();
        $chats = [];
        $response = $graph->setApiVersion("beta")
            ->createCollectionRequest("GET", "/me/chats")
            ->setReturnType(Chat::class);
        while (!$response->isEnd()) {
            $chats = array_merge($chats, $response->getPage());
        }

        return $chats;
    }

because the while loop never stops. @odata.nextLink is always present in the response for these users. Probably also a bug as by design the sdk checks if it's present.

  $maxRequests = 10;
   while (!$response->isEnd() && $maxRequests > 0) {
     $chats = array_merge($chats, $response->getPage());
     $maxRequests--;
   }