Microsoft Graph API – Retrieving Users' Working Hours via Service Principal

Question

Microsoft Graph API – Retrieving Users' Working Hours via Service Principal

Karmazina, Nataliia 0

Hello Microsoft Team,

we use Service Principle to create events in Outlook. Now we want to extend our SP, so that we can request a working hours for users in our tenant.

The endpoint we want to use: GET /users/{id | userPrincipalName}/settings/workHoursAndLocations
But according to the official documentation, Applications are not suported in this case: https://learn.microsoft.com/en-us/graph/api/workhoursandlocationssetting-get?view=graph-rest-1.0&tabs=http#http-request

Could you please confirm, that even if our Application or SP would have the required permission MailboxSettings.Read, we still wouldn't be able to call the endpoint: GET /users/{id | userPrincipalName}/settings/workHoursAndLocations

Thank you in advance!

Best regards
Nataliia

0 comments

4 answers

Your answer

Answer 1

Yes. A service principal cannot call GET /users/{id | userPrincipalName}/settings/workHoursAndLocations.

The API supports only delegated permissions for work or school accounts. For this endpoint:

Application permissions: Not supported
/me requires a signed-in user and delegated permission
/users/{id | userPrincipalName} is allowed only when the ID is the caller’s own user ID

That means granting MailboxSettings.Read to an application or service principal does not enable app-only access to this endpoint. MailboxSettings.Read is listed only under delegated permissions for this API.

The same limitation also applies to related work plan APIs such as:

occurrencesView
recurrences

Those also do not support application permissions.

References:

Answer 2

Karmazina, Nataliia 0

Are there any alternatives, which we can use?

0 comments

Answer 3

Hi Nataliia,

Yes, it can be confirmed your understanding is correct.

The Microsoft Graph endpoint: GET /users/{id | userPrincipalName}/settings/workHoursAndLocations does not support Application permissions. Microsoft Graph documentation stated only delegated permissions are supported and Application permissions are explicitly listed as "Not supported" for this API. Get workHoursAndLocationsSetting - Microsoft Graph beta

Therefore, even if your Service Principal is granted: it would still not be able to call the 'workHoursAndLocations' endpoint using an application-only token. The limitation is on the API itself rather than the permission assignment.

As an alternative, if your requirement is limited to retrieving users' standard working days, working hours, and time zone before creating Outlook events, you can use: This endpoint supports the MailboxSettings.Read Application permission and can be accessed using a Service Principal.
You may refer to the following Microsoft resources: Get user mailbox settings - Microsoft Graph v1.0 | Microsoft Learn

Hope this information would be helpful.

Should you have any further questions or need additional assistance, please feel free to share them in the comment below.

If the answer is helpful, please click 'Yes' and kindly upvote it. If you have any extra questions about this answer, please click "Comment".

Note: Please follow the steps in the forum documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 4

The endpoint in question does not support application permissions, so if your solution must use the work plan methods, we can only give you the bad news.

If you are open to using alternative methods, few things come to mind. First, you can fetch the user's free/busy (availability) info, which is possible via application permissions as well: https://learn.microsoft.com/en-us/graph/api/calendar-getschedule?view=graph-rest-beta&tabs=http

Another option is to fetch the user's working hours from the associated Exchange Online mailbox, either via the Graph's mailboxSettings resource or via PowerShell and the Get-MailboxCalendarConfiguration cmdlet: https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/get-mailboxcalendarconfiguration?view=exchange-ps

All the above methods support application permissions, and in the case of Get-MailboxCalendarConfiguration, you can also query the underlying endpoints directly, bypassing the PowerShell layer if needed.