Graph known issues

This page's changes and edits · All guidance changes

Microsoft's edit · 1 Mar 2023 14:54 UTC

Remove know issue

Microsoft's commit message in microsoftgraph/microsoft-graph-docs-contrib · commit d8593dd · +0 ~~−151~~ lines · also on GitHub

⋯ 406 unchanged lines

407407

408408 This error is due to intermittent license check failures, which we are working to fix. As a temporary workaround, add the **Directory.Read.All** permission. This temporary workaround will not be required when the issue is resolved.

409409

410 −## Security

411 −

412 −### Identity Protection security alerts do not return the userPrincipalName property

413 −

414 −The **userPrincipalName** property is no longer returned in responses to GET operation requests to the alerts API from the Azure AD Identity Protection security provider. This issue does not affect any other security providers.

415 −

416 −As a workaround, to get the user principal name (UPN):

417 −

418 −1. Request a security alert or list security alerts. Extract the Azure AD user identifier for each security alert record in the response.

419 −2. Call Microsoft Graph to resolve the Azure AD user identifier into a UPN. This requires your application to be granted an additional permission.

420 −3. Merge the results to get the security alert response details together with the UPN. If you're paging through results, repeat the steps for each page of results.

421 −

422 −You can use this workaround in client applications and PowerShell scripts. Because the client application that calls the alerts API works on a per-tenant basis, the security risk is minimal.

423 −

424 −#### Step 1: Retrieve the Identity Protection provider’s security alerts and extract the Azure AD IDs

425 −

426 −**Request**

427 −

428 −``` http

429 −GET https://graph.microsoft.com/v1.0/security/alerts?$filter=vendorInformation/provider eq 'IPC'&$top=10

430 −```

431 −

432 −**Response**

433 −

434 −In this example, the response is a collection of alerts from the provider.

435 −

436 −>**Note:** The response object shown here is shortened for readability.

437 −

438 −``` http

439 −HTTP/1.1 200 OK

440 −Content-type: application/json

441 −

442 −{

443 − "value": [

444 − {

445 − "activityGroupName": "activityGroupName-value",

446 − "assignedTo": "assignedTo-value",

447 − "azureSubscriptionId": "azureSubscriptionId-value",

448 − "azureTenantId": "azureTenantId-value",

449 − "category": "category-value",

450 − "closedDateTime": "datetime-value",

451 − "userStates": [

452 − {

453 − "aadUserId":"84b80893-8749-40a3-97b7-68513b600544"

454 − }

455 − ]

456 − },

457 − {

458 − "activityGroupName": "activityGroupName-value 2",

459 − "assignedTo": "assignedTo-value 2",

460 − "azureSubscriptionId": "azureSubscriptionId-value",

461 − "azureTenantId": "azureTenantId-value",

462 − "category": "category-value",

463 − "closedDateTime": "datetime-value",

464 − "userStates": [

465 − {

466 − "aadUserId":"5d6059b6-368d-45f8-91e1-8e07d485f1d0"

467 − }

468 − ]

469 − }

470 − ]

471 −}

472 −```

473 −

474 −From the response, create a collection of the **aadUserIds**. You’ll need this for the request body in the next step.

475 −

476 −```

477 −[

478 − "84b80893-8749-40a3-97b7-68513b600544",

479 − "5d6059b6-368d-45f8-91e1-8e07d485f1d0"

480 −]

481 −```

482 −

483 −#### Step 2: Resolve user Azure AD IDs into UPNs

484 −

485 −> [!NOTE]

486 −> To call the API, you need to grant your application an additional permission. If your app is using delegated permissions, grant the `User.ReadBasic.All` permission. If your app is using applicaton permissions, grant the `User.Read.All` permission.

487 −

488 −You can resolve the user IDs one at a time or in bulk. If you're listing alerts and paging through those results, we recommend that you resolve the IDs in bulk.

489 −

490 −##### Resolve a single aadUserId

491 −

492 −Use the [Get user](/graph/api/user-get) API to retrieve a single user object and its UPN, as shown in the following example.

493 −

494 −**Request**

495 −

496 −``` http

497 −GET https://graph.microsoft.com/v1.0/users/84b80893-8749-40a3-97b7-68513b600544?$select=id,userPrincipalName

498 −```

499 −

500 −**Response**

501 −

502 −``` http

503 −HTTP/1.1 200 OK

504 −Content-type: application/json

505 −

506 −{

507 − "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#users(id,userPrincipalName)/$entity",

508 − "id": "84b80893-8749-40a3-97b7-68513b600544",

509 − "userPrincipalName": "[email protected]"

510 −}

511 −```

512 −

513 −##### Resolve multiple aadUserIds by using a bulk operation

514 −

515 −Use the [directoryObject: getByIds](/graph/api/directoryobject-getbyids) API to get multiple user objects based on a list of Azure AD user IDs in the request body. This example uses the **aadUserId** collection from step 1 as the request body. You can include up to 999 IDs in this bulk operation.

516 −

517 −**Request**

518 −

519 −``` http

520 −POST https://graph.microsoft.com/v1.0/directoryObjects/getByIds?$select=id,userPrincipalName

521 −Content-type: application/json

522 −

523 −{

524 − "ids": [

525 − "84b80893-8749-40a3-97b7-68513b600544",

526 − "5d6059b6-368d-45f8-91e1-8e07d485f1d0"

527 − ]

528 −}

529 −```

530 −

531 −**Response**

532 −

533 −``` http

534 −HTTP/1.1 200 OK

535 −Content-type: application/json

536 −

537 −{

538 − "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#directoryObjects(id,userPrincipalName)",

539 − "value": [

540 − {

541 − "@odata.type": "#microsoft.graph.user",

542 − "id": "84b80893-8749-40a3-97b7-68513b600544",

543 − "userPrincipalName": "[email protected]"

544 − },

545 − {

546 − "@odata.type": "#microsoft.graph.user",

547 − "id": "5d6059b6-368d-45f8-91e1-8e07d485f1d0",

548 − "userPrincipalName": "[email protected]"

549 − }

550 − ]

551 −}

552 −```

553 −

554 −#### Step 3: Merge the results

555 −

556 −You can now merge the responses from step 1 and step 2 to join the IDs (**aadUserId** in the alerts response and **id** in the **getByIds** response) to create an alerts collection with the UPN included.

557 −

558 −> [!NOTE]

559 −> As a best practice, be aware of the throttling limits for Microsoft Graph APIs. For details, see [Microsoft Graph throttling guidane](https://learn.microsoft.com/en-us/graph/throttling).

560 −

561410 ## Sites and lists (SharePoint)

562411

563412 ### Follow/unfollow sites is not in sync with SharePoint following

⋯ 126 unchanged lines

Microsoft's Markdown source from microsoftgraph/microsoft-graph-docs-contrib, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 06:20 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.