#graph 53 articles
"0 sent" hides whether anyone was even asked — boolean mail wrappers conflate refusal with an empty audience gotchas / graph The recipient side of the same trap: a denied group read becomes an empty audience, an empty audience becomes a benign false, and an approval queue notifies nobody "User:… dont have any permissions" from the audit query API rejects the USER, not the app gotchas / graph Consent vs. Exchange audit role; Global Admin usually inherits it, so compare accounts /me/sendMail from an account without a mailbox can time out with 504 – and the Graph SDK retries it three more times gotchas / graph No MailboxNotEnabled error, just a 504 after ~30 s; the SDK RetryHandler repeats the non-idempotent POST up to 3×, so the button hangs ~2 min and a late success can send duplicates; check assignedPlans for an enabled… accountEnabled eq false is not a list of leavers — blocked shared mailboxes are in it too gotchas / graph blocked members ≠ former employees; tell shared mailboxes apart via the mailbox usage report's recipientType (needs real names) or mailboxSettings.userPurpose (per user) signInActivity without Entra ID P1 — the retry without it turns "not measured" into "0 inactive users" gotchas / graph Selecting signInActivity on /users fails with 403 in tenants without Entra ID P1/P2; the common fallback (retry without the property) makes every user look "never signed in" or gets skipped, so inactive-user and… A "grant it for me" button cannot work in a web part — not even for a Global Administrator gotchas / spfx A delegated call gets the intersection of the user's rights and the app's grants, so the admin at the keyboard adds nothing; writing the grant would take at least DelegatedPermissionGrant.ReadWrite.All approved for the… A comma in a Graph permissions table can mean AND — searching Teams messages needs two scopes gotchas / graph Searching chatMessage needs Chat.Read and ChannelMessage.Read.All; the 403 spells it out, the table does not (+ webUrl vs webLink from the same endpoint) A Graph scope your SPFx solution never asked for may already work — grants are tenant-wide gotchas / spfx webApiPermissionRequests is a request, not a grant; an approval lands on one tenant-wide principal, so a scope another solution had approved already works in yours (and may be missing at the customer) A mail-permission probe that can't tell "no mailbox" from "no consent" lies to admins gotchas / graph /me/messages 404 MailboxNotEnabled* on mailbox-less accounts ≠ missing consent; three verdicts, and never cache a negative probe result A mailto: fallback that reuses the success state tells the user their message was sent when it wasn't gotchas / graph sendMail fails on accounts without a mailbox and the fallback only hands a draft to a mail client; model sent / handed off / failed, never a boolean A network drop through the Microsoft Graph JS client looks like an HTTP error with status -1 gotchas / graph msgraph client wraps a failed fetch as GraphError statusCode -1, code TypeError – detect it, don't report "permission denied" A newsletter looped over /me/sendMail is not bulk e-mail — and ACS Email is no longer the way out gotchas / graph Per-mailbox and tenant limits, bulk mail through Microsoft 365 "isn't a supported use", JSON sendMail can't set List-Unsubscribe, ACS Email retires 2028; keep Graph for personal batches, send newsletters through an ESP… A page-size cap reported as a finding gotchas / rest-api A round number (100 / 500 / 999 / 5000) is the tell; the limit of the request presented as a measurement of the tenant, then cached A read-only mode that wraps SPHttpClient still sends e-mail — Graph is a second channel gotchas / spfx An SPFx app writes through two clients; wrapping SPHttpClient leaves mail, calendar and Planner wide open A screenshot pasted into a support form is too big for /me/sendMail — shrink it client-side gotchas / graph Inline base64 attachments share a ~4 MB request budget; shrink bitmaps in a canvas, cap the total, and remember mailto: fallbacks carry no attachments at all A Teams message your app posts in the user's name doesn't notify that user — and "I can't see it" needs a read-back, not a guess gotchas / graph Delegated ChatMessage.Send delivers (even to the self chat 48:notes), but Teams never alerts the sender; verify with GET + webUrl, notify from the app Adding or removing a group member via Graph needs the object ID — a UPN returns 400 "Invalid object identifier" gotchas / graph POST /groups/{id}/members/$ref and DELETE /groups/{id}/members/{id}/$ref accept only the user's object ID (GUID); a UPN from a people picker returns 400 Invalid object identifier — resolve it with GET… An archived site returns 423 on every Graph read — keep the site collection ID to reactivate it gotchas / graph archivalDetails is unreadable once archived; POST /sites/{host},{siteCollectionId}/unarchive still works An Entra group inside a SharePoint group is invisible to every membership check SharePoint offers gotchas / security SharePoint accepts an Entra group as a member of a site group, then never expands it: currentuser/groups is direct-only and sitegroups/{id}/users returns the group, not its people — resolve with Graph checkMemberGroups… ApplicationAccessPolicy won't scope to a shared mailbox — use a mail-enabled security group gotchas / graph "not a security principal"; scope app-only Mail.Send to a mail-enabled security group Approving Microsoft Graph permissions for SPFx needs a Global Administrator — Application Administrator is not enough gotchas / permissions API access requests for Microsoft Graph need Global Administrator (Application Administrator only covers third-party APIs), and admin consent for Graph application permissions such as Sites.Selected is explicitly… az CLI can't grant Sites.Selected — the scope is blocked by AADSTS65002 gotchas / graph sites/{id}/permissions needs Sites.FullControl.All; the CLI client can't request it (AADSTS65002), use the Graph PowerShell SDK Checking someone else's group membership — ask the group, not the user gotchas / graph /me/checkMemberGroups only answers for you; ask the GROUP for its transitive members instead, and never turn "could not determine" into "not a member" Creating a team right after creating its Microsoft 365 group returns 404 — retry only the 404, and don't log the failure as success gotchas / graph PUT /groups/{id}/team fails with 404 for minutes after POST /groups (replication); retry only 404, surface a real failure as a warning Creating a Teams channel returns 201 long before its SharePoint folder exists gotchas / graph POST /channels returns 201 while SharePoint provisions the folder minutes later; never hand-make the folder, report the pending state and let an idempotent rerun finish it directoryObject collections reject $select of user fields — and $top is a separate, per-endpoint trap gotchas / graph User fields on /members//transitiveMembers = 400; OData cast cures $select everywhere, $top stays per-endpoint (probe both) E-mail HTML built like a web page falls apart in Outlook gotchas / graph Classic Outlook renders with Word: no flexbox, rounded corners or gradients, so white text on a gradient vanishes; tables, solid colours, literal values, a full document, and under ~102 KB for Gmail Exchange Online Admin API (the REST behind EXO V3) cannot be called from the browser — no CORS, and SPFx tokens lack Exchange.Manage gotchas / graph adminapi/beta/{tenant}/InvokeCommand fails with 'Failed to fetch' even with a fake token; read Exchange config with an admin-run script and import, or use Graph message trace and mailbox reports GetUserEffectivePermissions ignores the user's Entra security groups — and Full Control's effective mask is not the role's mask gotchas / permissions Asked on behalf of another user, GetUserEffectivePermissions counts Microsoft 365 group membership but not Entra security group membership — directly assigned or nested in a SharePoint group, still after 40 s — so it… Graph /me/sendMail — From is always the signed-in user gotchas / graph Delegated Mail.Send can't impersonate; configure Reply-To instead Graph Search returns 0 hits — you passed the user's question as the queryString gotchas / search Translate question→keywords; "what's new" is a listing (* + default date sort, custom sort = 400); per-entity KQL only as documented Graph usage reports in the browser — the v1.0 CSV redirect is CORS-blocked, beta JSON works gotchas / graph v1.0 302 to CSV dies on CORS; beta ?$format=application/json returns 200 from Graph; mind roles and concealed names Message Center via Graph — with $orderby you may get one page and no nextLink; page with $skip gotchas / graph messages?$top=100&$orderby=… returned 100 posts without @odata.nextLink; $top + $skip returned all 441 Microsoft To Do rejects $select on lists and tasks — 400 invalidRequest (RequestBroker--ParseUri) gotchas / graph Since Oct 2026 /me/todo/lists and /tasks return 400 for any $select except id; drop $select, keep $top/$filter, and measure 400s call by call before trusting a docs-based theory Microsoft To-Do (/me/todo) needs an Exchange mailbox — admin accounts 404 gotchas / graph 404 "Item not found" on admin/cloud-only accounts is not a 403; Planner works without a mailbox Office files change their content hash when you PATCH metadata — property demotion gotchas / graph Metadata PATCH and copy jobs rewrite Office, .msg and .htm file bytes; key change detection on lastModifiedBy, never compare sizes exactly Opening a pre-filled e-mail — with an attachment — in the user's desktop Outlook gotchas / spfx No API tells you which mail client is default; mailto: reaches it but carries no attachment, and a .eml needs X-Unsent: 1 or it opens read-only PATCH /me — directory and profile fields cannot share one request gotchas / graph Mixed field groups fail whole; two PATCHes, profile best-effort perUserMfaState says "disabled" even when MFA is enforced — don't report it as "user has no MFA" gotchas / graph The legacy per-user switch stays off while MFA is fully enforced; report on userRegistrationDetails instead — which omits blocked accounts and needs an undocumented Entra ID P1/P2 tenant preAuthorizedApplications can't reference a scope created in the same PATCH gotchas / graph Graph checks delegatedPermissionIds against stored scopes; scope and its pre-authorization need two separate PATCH calls Purview audit objectIdFilters can return nothing — silently gotchas / graph Narrowed to one library: 0 records, no error; without the filter 1,000 records, 38 of them for that library — ask for a window, filter by object locally, A/B every server-side filter Purview audit query API — a query for a service you have no scope for still "succeeds" with 0 records gotchas / graph With only AuditLogsQuery-SharePoint.Read.All, Exchange and Entra queries return 201 → succeeded → 0 records; an unfiltered query returns only SharePoint records Re-read fresh right before you bulk-remove group members gotchas / graph The roster you showed is a preview; strict fresh re-read before a removeMember loop, read-error aborts, vanished member = idempotent skip Reading Teams channel messages needs a Teams license — a Global Admin without one gets 403 even as a team member gotchas / graph Delegated GET /teams/{id}/channels/{id}/messages returns 403 'Failed to get license information for the user' for an unlicensed account even with ChannelMessage.Read.All consented and team membership; a licensed member… Service health — a cross-service outage is filed under "Microsoft 365 suite", not under SharePoint or Exchange gotchas / graph Filtering serviceAnnouncement/issues by service dropped MO1550821 (12 Nov 2026, users unable to connect to multiple Microsoft 365 services) — its service was Microsoft 365 suite SharePoint REST vs Microsoft Graph — which API for which job guides A decision table by capability, the SPFx auth difference, common wrong picks, and throttling budgets SPFx MSGraphClient calls don't show in DevTools Network — and how to diagnose them anyway gotchas / graph SPFx Graph traffic invisible in Network; diagnose via performance entries, currentuser, DOM, user's response Tenant-wide enumeration in Graph is app-only — check Delegated vs Application before you build gotchas / graph getAllSites rejects delegated tokens; check the Permissions table first The memberOf operator in dynamic group rules stops working on 3 November 2026 — groups freeze instead of failing gotchas / graph Entra ends the memberOf preview operator in dynamic membership rules on 3 Nov 2026 (MC1448379): affected groups, dynamic admin units and auto-assignment policies keep their last membership and never update again.… The Microsoft Graph JS client sends $filter values unencoded — & splits the query, # cuts it off gotchas / graph .filter(), .query() and .api('…?…') pass the value into the URL as-is (SDK 3.0.2, also under SPFx MSGraphClientV3): # cuts the query, & splits it and .api() even moves $top into the filter; double apostrophes, then… The Purview Audit Query API is asynchronous — think in hours, not seconds gotchas / graph Hour-long queries; attach to the last succeeded, create in background Which Entra ID roles are privileged? isPrivileged is beta-only, and a hand-written list gets it wrong gotchas / graph Read isPrivileged live from beta roleDefinitions – v1.0 omits it and 400s on $select=isPrivileged; Exchange/SharePoint/Teams admins are not privileged Wrapping MSGraphClientV3 to count calls fails silently — and your fail-safe catch hides it gotchas / spfx Reassigning client.api throws and your fail-safe catch hides it; use Object.create and assert it attached