1 of 5 requests to Graph API /users/licensedetails fail with 401 Unauthorized

Tobias Ask 6 Reputation points Microsoft Employee
2023-01-02T11:14:35.34+00:00

Hi, I'm on a team that works on an internal Microsoft service. We are calling the Graph /users/licensedetails endpoint in a background processing context to get the user's licenses, and it fails roughly 1/5 of the time with 401 Unathorized responses; otherwise, it succeeds. We have set up auth with an application permission to the default scope, and we are using MSAL in .NET Core to get tokens. My best guess would be that the error is caused by expired tokens since it works 4/5 times, but then I also understand that MSAL should handle renewal automatically, so I'm hoping to get some help here.

Here are details from the headers of a 401 response:

  • request-id: 5fe76a9b-a2b2-4ef9-b093-64388558d5dd
  • Date: Mon, 02 Jan 2023 10:09:15 GMT
  • x-ms-ags-diagnostic: {"ServerInfo":{"DataCenter":"North Central US","Slice":"E","Ring":"3","ScaleUnit":"005","RoleInstance":"CH01EPF00016950"}}
  • client-request-id: 6a157167-3989-4bfe-944e-6eac76517e65
Microsoft Security | Microsoft Graph

5 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Tobias Ask 6 Reputation points Microsoft Employee
    2023-01-06T08:12:59.287+00:00

    Root cause that was masking the simpler error was using the "https://login.microsoftonline.com/<USER_TENANT_ID>" authority URL when getting tokens from MSAL, instead of the one meant for multitenant apps, "https://login.microsoftonline.com/organizations/".

    Was this answer helpful?

    0 comments
  2. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

    2 deleted comments

    Comments have been turned off. Learn more

  3. Tobias Ask 6 Reputation points Microsoft Employee
    2023-01-03T11:21:47.49+00:00

    Thanks for your replies. We can start to log the error code (as described here https://learn.microsoft.com/en-us/graph/errors?view=graph-rest-1.0#code-property) from the response body as @CarlZhao-MSFT suggests.

    @Gopinath Chennamadhavuni :

    Error 401 is an Unauthorized error. Make sure that your application is presenting a valid access token to Microsoft Graph as part of the request. This error often means that the access token may be missing in the HTTP authenticate request header or that the token is invalid or has expired.

    We always include the token in the Authorization request header. The success rate of roughly 80% indicates that the request is formed correctly.

    We strongly recommend that you use the Microsoft Authentication Library (MSAL) for access token acquisition.

    We are using MSAL for .NET Core to get tokens. As I understand, the library should automatically renew expired tokens.

    Are any of you able to check the logs for the specific request I've posted details about?

    Was this answer helpful?

    0 comments
  4. Gopinath Chennamadhavuni 2,446 Reputation points
    2023-01-03T07:39:43.89+00:00

    Hi @Tobias Ask ,

    Thank you for reaching out to us. As I see you are getting error 401 while performing GET /users/licensedetails to Graph API.

    Error 401 is an Unauthorized error. Make sure that your application is presenting a valid access token to Microsoft Graph as part of the request. This error often means that the access token may be missing in the HTTP authenticate request header or that the token is invalid or has expired.

    We strongly recommend that you use the Microsoft Authentication Library (MSAL) for access token acquisition.

    Hope this helps.

    If the answer is helpful, please click /users/licensedetails and kindly upvote. If you have any further questions about this answer, please click Comment.

    Was this answer helpful?

  5. Vicky Kumar (Mindtree Consulting PVT LTD) 1,161 Reputation points Microsoft Employee
    2023-01-02T17:03:38.607+00:00

    Thanks for reaching out to us, this might be due to token expiration, the expiry time of the token is about one hour, you can try the doc to Refresh token lifetime - https://learn.microsoft.com/en-us/azure/active-directory/develop/refresh-tokens . Hope this helps.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.