401 error returned when getting chats through Graph API

Hi @Rich,

Welcome to Microsoft Q&A, and thank you very much for reaching out to us.

Please note that our forum is a public platform, and we will modify your question to hide your personal information in the description. Kindly ensure that you hide any personal or organizational information the next time you post an error or other details to protect personal data.

Based on your description, your application appears to have the required Microsoft Graph permissions configured. However, you are still receiving a 401 Unauthorized error.

To help troubleshoot further, could you please provide the application’s configuration JSON file? This will allow me to verify how the token is being requested and whether the correct scopes are included.

Additionally, I noticed you mentioned using SSO. Could you clarify why this approach was chosen? For Microsoft Graph API calls, the token must be an access token (not just an ID token) to work correctly.

To check, you can decode the token at https://jwt.ms:

• If you see scp or roles and aud = https://graph.microsoft.com > Access Token.
• If you see aud = your app’s client ID and no scp > ID Token.

Also, kindly please ensure that you have all the required permissions and scopes for the chat endpoint, you can find the complete list in this Microsoft Article here. As 401 error often indicates that the token does not include the necessary permissions and scopes.

Thank you very much for your time, I am looking forward to your response.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Hi, thanks for replying. I have checked. It's an access token. After SSO login in My SpringBoot project, it will enter into following logic:

// spring security config class code block
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
      .....
    return http.oauth2Login(oauth2 -> 
       oauth2.userInfoEndpoint(userInfo ->
          userInfo.oidcUserService(azureOidcUserService))
                  .successHandler(azureOauth2SuccessHandler))
      .build();
}

// ------- AzureOidcUserService.java ------

public class AzureOidcUserService extends OidcUserService {

    @Override
    public OidcUser loadUser(OidcUserRequest userRequest) throws OAuth2AuthenticationException {
        OidcUser oidcUser = super.loadUser(userRequest);
    	String accessToken = userRequest.getAccessToken().getTokenValue();  // here is accessToken
    	System.out.println("[AzureOidcUserService] Access Token: " + accessToken);
    	System.out.println("--------------------------------------------------------------------");
    	System.out.println("[AzureOidcUserService] Invoked. Claims: " + oidcUser.getClaims());

}

From https://jwt.ms/, You can see the result:

Then I used that token to get chats through API.

curl --location 'https://graph.microsoft.com/v1.0/me/chats' \
--header 'Authorization: Bearer <token>'

401 error happened.