ChangeIntelIT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources or documents need attention: 258/260 feeds/APIs · 416/439 docs · checked 22:55 UTC Customize Public modeDiscuss ChangeIntel on Discord

Graph known issues

This page's changes and edits · All guidance changes

Microsoft's edit ·

Fix #19955 and various formatting fixes

Microsoft's commit message in microsoftgraph/microsoft-graph-docs-contrib · commit c7ff5f3 · +70 −57 lines · also on GitHub

⋯ 20 unchanged lines
2121
2222 Current limitations:
2323
24 −* Some application properties (such as appRoles and addIns) will not be available until all changes are completed.
25 −* Only multi-tenant apps can be registered.
26 −* Updating apps is restricted to apps registered after the initial beta update.
27 −* Azure Active Directory users can register apps and add additional owners.
28 −* Support for OpenID Connect and OAuth protocols.
29 −* Policy assignments to an application fail.
30 −* Operations on ownedObjects that require appId fail (For example, users/{id|userPrincipalName}/ownedObjects/{id}/...).
24 +- Some application properties (such as appRoles and addIns) will not be available until all changes are completed.
25 +- Only multi-tenant apps can be registered.
26 +- Updating apps is restricted to apps registered after the initial beta update.
27 +- Azure Active Directory users can register apps and add additional owners.
28 +- Support for OpenID Connect and OAuth protocols.
29 +- Policy assignments to an application fail.
30 +- Operations on ownedObjects that require appId fail (For example, users/{id|userPrincipalName}/ownedObjects/{id}/...).
3131
3232 In development:
3333
34 −* Ability to register single tenant apps.
35 −* Updates to servicePrincipal.
36 −* Migration of existing Azure AD apps to updated model.
37 −* Support for appRoles, pre-authorized clients, optional claims, group membership claims, and branding
38 −* Microsoft account (MSA) users can register apps.
34 +- Ability to register single tenant apps.
35 +- Updates to servicePrincipal.
36 +- Migration of existing Azure AD apps to updated model.
37 +- Support for appRoles, pre-authorized clients, optional claims, group membership claims, and branding
38 +- Microsoft account (MSA) users can register apps.
3939
4040 ### Azure AD v2.0 endpoint is not supported for CSP apps
4141
⋯ 24 unchanged lines
6666 ```PowerShell
6767 New-AzureADServicePrincipal -AppId 00000003-0000-0000-c000-000000000000
6868 ```
69 +
6970 ## Bookings
7071
7172 ### Error when querying bookingBusinesses
⋯ 15 unchanged lines
8788 ```http
8889 GET https://graph.microsoft.com/beta/bookingBusinesses?query=Fabrikam
8990 ```
91 +
9092 ## Calendar
9193
9294 ### Error accessing a shared calendar
⋯ 12 unchanged lines
105107 - You can use the calendar REST API to view or edit shared calendars only if the calendars were shared using the **new** approach.
106108 - You cannot use the calendar REST API to view or edit such calendars (or their events) if the calendars were shared using the **old** approach.
107109
108 −
109110 If a calendar was shared with view or edit permissions but using the old approach, you can now work around the error and manually upgrade the calendar sharing to use the new approach.
110111 Over time, Outlook will automatically upgrade all shared calendars to use the new approach, including calendars shared with delegate permissions.
111112
112113 To manually upgrade a shared calendar to use the new approach, follow these steps:
113 −1. The recipient removes the calendar that was previously shared to them.
114 −2. The calendar owner re-shares the calendar in Outlook on the web, Outlook on iOS, or Outlook on Android.
115 −3. The recipient re-accepts the shared calendar using Outlook on the web. (It will be possible to use other Outlook clients soon.)
116 −4. The recipient verifies that the calendar has been re-shared successfully using the new approach by being able to view the shared calendar in Outlook on iOS or Outlook on Android.
117114
115 +1. The recipient removes the calendar that was previously shared to them.
116 +2. The calendar owner re-shares the calendar in Outlook on the web, Outlook on iOS, or Outlook on Android.
117 +3. The recipient re-accepts the shared calendar using Outlook on the web. (It will be possible to use other Outlook clients soon.)
118 +4. The recipient verifies that the calendar has been re-shared successfully using the new approach by being able to view the shared calendar in Outlook on iOS or Outlook on Android.
119 +
118120 A calendar shared with you in the new approach appears as just another calendar in your mailbox. You can use the calendar REST API to view or edit
119121 events in the shared calendar, as if it's your own calendar. As an example:
120122
⋯ 5 unchanged lines
126128
127129 Currently, calendars based on an Internet Calendar Subscription (ICS) are only partially supported:
128130
129 −* You can add an ICS-based calendar to a user mailbox through the UI, but not through the Microsoft Graph API.
130 −* [Listing the user's calendars](/graph/api/user-list-calendars) lets you get the **name**, **color** and **id** properties of each [calendar](/graph/api/resources/calendar) in the user's default calendar group, or a specified calendar group, including any ICS-based calendars. You cannot store or access the ICS URL in the calendar resource.
131 −* You can also [list the events](/graph/api/calendar-list-events) of an ICS-based calendar.
131 +- You can add an ICS-based calendar to a user mailbox through the UI, but not through the Microsoft Graph API.
132 +- [Listing the user's calendars](/graph/api/user-list-calendars) lets you get the **name**, **color** and **id** properties of each [calendar](/graph/api/resources/calendar) in the user's default calendar group, or a specified calendar group, including any ICS-based calendars. You cannot store or access the ICS URL in the calendar resource.
133 +- You can also [list the events](/graph/api/calendar-list-events) of an ICS-based calendar.
132134
133135 ### Error attaching large files to events
136 +
134137 An app with delegated permissions returns `HTTP 403 Forbidden` when attempting to [attach large files](outlook-large-attachments.md) to an Outlook message or event that is in a shared or delegated mailbox. With delegated permissions, [createUploadSession](/graph/api/attachment-createuploadsession) succeeds only if the message or event is in the signed-in user's mailbox.
135138
136139 ### onlineMeetingUrl property is not supported for Microsoft Teams
⋯ 74 unchanged lines
211214 GET /me/contacts/{id}
212215 GET /users/{id | userPrincipalName}/contacts/{id}
213216 ```
217 +
214218 ## Delta query
215219
216220 ### OData context is returned incorrectly
⋯ 14 unchanged lines
231235
232236 Accessing and updating deployment audiences on **deployment** resources created via Intune is not currently supported.
233237
234 −* [Listing deployment audience members](/graph/api/windowsupdates-deploymentaudience-list-members) and [listing deployment audience exclusions](/graph/api/windowsupdates-deploymentaudience-list-exclusions) returns `404 Not Found`.
235 −* [Updating deployment audience members and exclusions](/graph/api/windowsupdates-deploymentaudience-updateaudience) or [updating by ID](/graph/api/windowsupdates-deploymentaudience-updateaudiencebyid) returns `202 Accepted` but the audience is not updated.
238 +- [Listing deployment audience members](/graph/api/windowsupdates-deploymentaudience-list-members) and [listing deployment audience exclusions](/graph/api/windowsupdates-deploymentaudience-list-exclusions) returns `404 Not Found`.
239 +- [Updating deployment audience members and exclusions](/graph/api/windowsupdates-deploymentaudience-updateaudience) or [updating by ID](/graph/api/windowsupdates-deploymentaudience-updateaudiencebyid) returns `202 Accepted` but the audience is not updated.
236240
237241 ## Extensions
238242
⋯ 43 unchanged lines
282286
283287 Examples of group features that support delegated and app-only permissions:
284288
285 −* Creating and deleting groups
286 −* Getting and updating group properties pertaining to group administration or management
287 −* Group [directory settings](/graph/api/resources/directoryobject), type, and synchronization
288 −* Group owners and membership
289 −* Getting group conversations and threads
289 +- Creating and deleting groups
290 +- Getting and updating group properties pertaining to group administration or management
291 +- Group [directory settings](/graph/api/resources/directoryobject), type, and synchronization
292 +- Group owners and membership
293 +- Getting group conversations and threads
290294
291295 Examples of group features that support only delegated permissions:
292296
293 −* Group events, photo
294 −* External senders, accepted or rejected senders, group subscription
295 −* User favorites and unseen count
297 +- Group events, photo
298 +- External senders, accepted or rejected senders, group subscription
299 +- User favorites and unseen count
296300
297301 ### Microsoft Graph bypasses group policies configured through Outlook on the web
298302
⋯ 50 unchanged lines
349353
350354 JSON batch requests are currently limited to 20 individual requests.
351355
352 −* Depending on the APIs part of the batch request, the underlying services impose their own throttling limits that affect applications that use Microsoft Graph to access them.
353 −* Requests in a batch are evaluated individually against throttling limits and if any request exceeds the limits, it fails with a status of 429.
356 +- Depending on the APIs part of the batch request, the underlying services impose their own throttling limits that affect applications that use Microsoft Graph to access them.
357 +- Requests in a batch are evaluated individually against throttling limits and if any request exceeds the limits, it fails with a status of 429.
354358
355359 For more details, visit [Throttling and batching](/graph/throttling#throttling-and-batching).
356360
⋯ 41 unchanged lines
398402 }
399403 }
400404 ```
405 +
401406 This error might also occur when retrieving the **signInActivity** property of the [user](/graph/api/resources/user?view=graph-rest-beta&preserve-view=true) resource; for example, `https://graph.microsoft.com/beta/users?$select=signInActivity`.
402407
403408 This error is due to intermittent license check failures, which we are working to fix. As a temporary workaround, add the **Directory.Read.All** permission. This temporary workaround will not be required when the issue is resolved.
⋯ 6 unchanged lines
410415
411416 As a workaround, to get the user principal name (UPN):
412417
413 −1. Request a security alert or list security alerts. Extract the Azure AD user identifier for each security alert record in the response.
414 −2. Call Microsoft Graph to resolve the Azure AD user identifier into a UPN. This requires your application to be granted an additional permission.
415 −3. Merge the results to get the security alert response details together with the UPN. If you're paging through results, repeat the steps for each page of results.
418 +1. Request a security alert or list security alerts. Extract the Azure AD user identifier for each security alert record in the response.
419 +2. Call Microsoft Graph to resolve the Azure AD user identifier into a UPN. This requires your application to be granted an additional permission.
420 +3. Merge the results to get the security alert response details together with the UPN. If you're paging through results, repeat the steps for each page of results.
416421
417422 You can use this workaround in client applications and PowerShell scripts. Because the client application that calls the alerts API works on a per-tenant basis, the security risk is minimal.
418423
⋯ 143 unchanged lines
562567 ## Teamwork (Microsoft Teams)
563568
564569 ### Unable to filter team members by roles
570 +
565571 Role query filters along with other filters `GET /teams/team-id/members?$filter=roles/any(r:r eq 'owner') and displayName eq 'dummy'` might not work. The server might respond with a `BAD REQUEST`.
566572
567573 ### Requests to filter team members by role require a parameter
⋯ 1 unchanged line
569575 All the requests to filter team members by roles expect either a _skipToken_ parameter or a _top_ paramater in the request, but not both. If both the parameters are passed in the request, the _top_ parameter will be ignored.
570576
571577 ### Some properties for chat members might be missing in the response to a GET request
578 +
572579 In certain instances, the `tenantId` / `email` / `displayName` property for the individual members of a chat might not be populated on a `GET /chats/chat-id/members` or `GET /chats/chat-id/members/membership-id` request.
573580
574581 ### Properties are missing in the list of teams that a user has joined
582 +
575583 The API call for [me/joinedTeams](/graph/api/user-list-joinedteams) returns only the **id**, **displayName**, and **description** properties of a [team](/graph/api/resources/team). To get all properties, use the [Get team](/graph/api/team-get) operation.
576584
577585 ### Installation of apps that require resource-specific consent permissions is not supported
586 +
578587 The following API calls do not support installing apps that require [resource-specific consent](/microsoftteams/platform/graph-api/rsc/resource-specific-consent) permissions.
588 +
579589 - [Add app to team](/graph/api/team-post-installedapps)
580590 - [Upgrade app installed in team](/graph/api/team-teamsappinstallation-upgrade)
581591 - [Add app to chat](/graph/api/chat-post-installedapps)
582592 - [Upgrade app installed in chat](/graph/api/chat-teamsappinstallation-upgrade.md)
583593
584594 ### Unable to access a cross-tenant shared channel when the request URL contains tenants/{cross-tenant-id}
595 +
585596 The API calls for [teams/{team-id}/incomingChannels](/graph/api/team-list-incomingchannels.md) and [teams/{team-id}/allChannels](/graph/api/team-list-allchannels.md) return the **@odata.id** property which you can use to access the channel and run other operations on the [channel](/graph/api/resources/channel.md) object. If you call the URL returned from the **@odata.id** property, the request fails with the following error when it tries to access the cross-tenant shared [channel](/graph/api/resources/channel.md):
586597 ```http
587598 GET /tenants/{tenant-id}/teams/{team-id}/channels/{channel-id}
⋯ 9 unchanged lines
597608 }
598609 }
599610 ```
611 +
600612 To solve this issue, remove the `/tenants/{tenant-id}` part from the URL before you call the API to access the cross-tenant shared [channel](/graph/api/resources/channel.md).
601613
602614 ### TeamworkAppSettings permissions are not visible in the Azure portal
615 +
603616 The permissions TeamworkAppSettings.Read.All and TeamworkAppSettings.ReadWrite.All are currently being rolled out and might not be visible in Azure Portal yet. To consent to these permissions, please use an authorize request as follows:
604617
605618 ```http
⋯ 21 unchanged lines
627640 "message": "The SMTP address has no mailbox associated with it."
628641 }
629642 }
630 − ```
643 + ```
644 +
631645 2. Any photos that *may* have been previously stored using the **thumbnailPhoto** property (using the Azure AD Graph API (deprecated) or through AD Connect synchronization) are no longer accessible through the Microsoft Graph **photo** property of the [user](/graph/api/resources/user) resource.
632646 3. Managing users' photos through the [profilePhoto resource](/graph/api/resources/profilephoto) of the Microsoft Graph API is currently not supported in Azure AD B2C tenants.
633647
⋯ 15 unchanged lines
649663
650664 The following limitations apply to query parameters:
651665
652 −* Multiple namespaces are not supported.
653 −* GET requests on `$ref` and casting are not supported on users, groups, devices, service principals, and applications.
654 −* `@odata.bind` is not supported. This means that you can't properly set the **acceptedSenders** or **rejectedSenders** navigation property on a group.
655 −* `@odata.id` is not present on non-containment navigations (like messages) when using minimal metadata.
656 −* `$expand`:
657 − * Returns a maximum of 20 objects.
658 − * No support for `@odata.nextLink`.
659 − * No support for more than one level of expand.
660 − * No support with extra parameters (`$filter`, `$select`).
661 −* `$filter`:
662 − * `/attachments` endpoint does not support filters. If present, the `$filter` parameter is ignored.
663 − * Cross-workload filtering is not supported.
664 −* `$search`:
665 − * Full-text search is only available for a subset of entities, such as messages.
666 − * Cross-workload searching is not supported.
667 − * Searching is not supported in Azure AD B2C tenants.
668 −* `$count`:
669 − * Not supported in Azure AD B2C tenants.
670 − * When using the `$count=true` query string when querying against directory resources, the `@odata.count` property will be present only in the first page of the paged data.
671 −* Query parameters specified in a request might fail silently. This can be true for unsupported query parameters as well as for unsupported combinations of query parameters.
672 −
666 +- Multiple namespaces are not supported.
667 +- GET requests on `$ref` with casting are not supported on users, groups, devices, service principals, and applications.
668 +- `@odata.bind` is not supported. This means that you can't properly set the **acceptedSenders** or **rejectedSenders** navigation property on a group.
669 +- `@odata.id` is not present on non-containment navigations (like messages) when using minimal metadata.
670 +- `$expand`:
671 + - For directory objects, returns a maximum of 20 objects.
672 + - No support for `@odata.nextLink`.
673 + - No support for more than one level of expand.
674 + - For directory objects, no support for nesting other query parameters such as `$filter` and `$select` in `$expand`.
675 +- `$filter`
676 + - `/attachments` endpoint does not support filters. If present, the `$filter` parameter is ignored.
677 + - Cross-workload filtering is not supported.
678 +- `$search`:
679 + - Full-text search is only available for a subset of entities, such as messages.
680 + - Cross-workload searching is not supported.
681 + - Searching is not supported in Azure AD B2C tenants.
682 +- `$count`:
683 + - Not supported in Azure AD B2C tenants.
684 + - When using the `$count=true` query string when querying against directory objects, the `@odata.count` property will be present only in the first page of the paged data.
685 +- Query parameters specified in a request might fail silently. This can be true for unsupported query parameters as well as for unsupported combinations of query parameters.
673686
674687 ## Functionality available only in Office 365 REST or Azure AD Graph APIs (deprecated)
675688
⋯ 1 unchanged line

Microsoft's Markdown source from microsoftgraph/microsoft-graph-docs-contrib, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 06:20 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 20 Oct 22:55 UTC · 258 of 260 readable · 256 fully read · documentation 416/439 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.