Skip to content

Commit 9f80b36

Browse files
FaithOmbongiFaithOmbongi
authored
Merge pull request #28266 from microsoftgraph/migrateknownissues
Migrate known issues
2 parents d3c4b24 + 11488c8 commit 9f80b36

16 files changed

Lines changed: 791 additions & 0 deletions

‎concepts/includes/known-issues/authentication.md‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
---
2+
author: ombongifaith
3+
ms.topic: include
4+
ms.date: 02/06/2026
5+
ms.localizationpriority: medium
6+
---
7+
8+
### Publisher message of "unverified" occurs during PowerShell and CLI app consent
9+
10+
<!-- {
11+
"ms.author": "ckigoonya",
12+
"ms.reviewer": ""
13+
} -->
14+
15+
The consent page shows that the command-line app that caters to PowerShell and CLI is from an unverified publisher.
16+
17+
#### Workaround
18+
19+
To remove the "unverified" message, you can do an app registration of your own, on which you can set yourself as the verified publisher. You need to go through the publisher verification process, and use the app ID on the Microsoft Graph PowerShell SDK, as follows:
20+
21+
```powershell
22+
Connect-MgGraph -AppId "{your-own-app-id}" -Scopes "scope"
23+
```
24+
25+
### Pre-consent for CSP apps doesn't work in some customer tenants
26+
27+
<!-- {
28+
"ms.author": "sureshja",
29+
"ms.reviewer": ""
30+
} -->
31+
32+
Under certain circumstances, pre-consent for cloud solution provider (CSP) apps may not work for some of your customer tenants.
33+
34+
For apps using delegated permissions, when using the app for the first time with a new customer tenant, you might receive this error after sign-in: `AADSTS50000: There was an error issuing a token`.
35+
36+
For apps using application permissions, your app can acquire a token, but unexpectedly gets an access denied message when calling Microsoft Graph.
37+
38+
We're working to fix this issue, so that preconsent works for all CSP customer tenants.
39+
40+
#### Workaround
41+
42+
To unblock development and testing, you can use the following workaround.
43+
44+
> [!NOTE]
45+
> This isn't a permanent solution and is only intended to unblock development. This workaround won't be required once the issue is fixed. This workaround doesn't need to be undone after the fix is in place.
46+
47+
1. Open an Azure AD v2 PowerShell session and connect to your customer tenant by entering your admin credentials into the sign-in window. You can download and install Azure AD PowerShell V2 from [here](https://www.powershellgallery.com/packages/AzureAD).
48+
49+
```powershell
50+
Connect-AzureAd -TenantId {customerTenantIdOrDomainName}
51+
```
52+
53+
2. Create the Microsoft Graph service principal.
54+
55+
```powershell
56+
New-AzureADServicePrincipal -AppId 00000003-0000-0000-c000-000000000000
57+
```
58+
59+
### Azure AD v2.0 endpoint isn't supported for CSP apps
60+
61+
<!-- {
62+
"ms.author": "sureshja",
63+
"ms.reviewer": ""
64+
} -->
65+
66+
Cloud solution provider (CSP) apps must acquire tokens from the Azure AD (v1) endpoints to successfully call Microsoft Graph in their partner-managed customers. Currently, acquiring a token through the newer Azure AD v2.0 endpoint isn't supported.

‎concepts/includes/known-issues/calendar.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
---
2+
author: ombongifaith
3+
ms.topic: include
4+
ms.date: 02/06/2026
5+
ms.localizationpriority: medium
6+
---
7+
8+
### Error attaching large files to events
9+
10+
<!-- {
11+
"ms.author": "abhda",
12+
"ms.reviewer": ""
13+
} -->
14+
15+
An app with delegated permissions returns `HTTP 403 Forbidden` when attempting to attach large files to an Outlook message or event that is in a shared or delegated mailbox. With delegated permissions, [createUploadSession](/graph/api/attachment-createuploadsession) succeeds only if the message or event is in the signed-in user's mailbox.

‎concepts/includes/known-issues/change-notifications.md‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
author: ombongifaith
3+
ms.topic: include
4+
ms.date: 02/25/2026
5+
ms.localizationpriority: medium
6+
---
7+
8+
### Upgrade events for Teams app installation change notifications in chat scope aren't delivered
9+
10+
<!-- {
11+
"ms.author": "",
12+
"ms.reviewer": ""
13+
} -->
14+
15+
When a subscription for a Teams app installation change notification is created, if the scope is specific to or includes chats, upgrade events/notifications aren't delivered to the subscriber.
16+
17+
For example: If a customer subscribes to `/appCatalogs/teamsApps/{teams-app-id}/installations?$filter=(scopeInfo/scope eq 'groupChat')`, they won't receive notifications for upgrade/update events. However, they receive other notifications regarding installations and deletions.
18+
19+
Another example: If a customer subscribes to `/appCatalogs/teamsApps/{teams-app-id}/installations`, they won't receive notifications for upgrade/update events occurring specifically within chats. However, they receive all other forms of notifications in teams and user's personal scope. But, in chats, they only receive installation and deletion notifications.
20+
21+
#### Workaround
22+
23+
Currently no workaround for this issue is available.

‎concepts/includes/known-issues/customer-booking.md‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
---
2+
author: ombongifaith
3+
ms.topic: include
4+
ms.date: 02/06/2026
5+
ms.localizationpriority: medium
6+
---
7+
8+
### Error when querying bookingBusinesses
9+
10+
<!-- {
11+
"ms.author": "jhayes",
12+
"ms.reviewer": ""
13+
} -->
14+
15+
Getting the list of **bookingBusinesses** fails with the following error code when an organization has several Bookings businesses and the account making the request is not an administrator:
16+
17+
```json
18+
{
19+
"error": {
20+
"code": "ErrorExceededFindCountLimit",
21+
"message": "The GetBookingMailboxes request returned too many results. Please specify a query to limit the results."
22+
}
23+
}
24+
```
25+
26+
#### Workaround
27+
28+
You can limit the set of businesses returned by the request by including a query parameter, for example:
29+
30+
```http
31+
GET https://graph.microsoft.com/beta/bookingBusinesses?query=Fabrikam
32+
```

‎concepts/includes/known-issues/delta-query.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
---
2+
author: ombongifaith
3+
ms.topic: include
4+
ms.date: 02/06/2026
5+
ms.localizationpriority: medium
6+
---
7+
8+
### OData context is returned incorrectly
9+
10+
<!-- {
11+
"ms.author": "dkershaw",
12+
"ms.reviewer": ""
13+
} -->
14+
15+
OData context is sometimes returned incorrectly when tracking changes to relationships.

‎concepts/includes/known-issues/device-app-management.md‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
author: ombongifaith
3+
ms.topic: include
4+
ms.date: 02/06/2026
5+
ms.localizationpriority: medium
6+
---
7+
8+
### Accessing and updating deployment audiences is not supported
9+
10+
<!-- {
11+
"ms.author": "altang",
12+
"ms.reviewer": ""
13+
} -->
14+
15+
Accessing and updating deployment audiences on deployment resources created via Intune is not currently supported.
16+
17+
- Listing deployment audience members and listing deployment audience exclusions returns `404 Not Found`.
18+
- Updating deployment audience members and exclusions or updating by ID returns `202 Accepted` but the audience is not updated.

‎concepts/includes/known-issues/groups.md‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
---
2+
author: ombongifaith
3+
ms.topic: include
4+
ms.date: 02/06/2026
5+
ms.localizationpriority: medium
6+
---
7+
8+
### Nonadmin user can't add self as group owner during group creation or update
9+
10+
<!-- {
11+
"ms.author": "yuhko",
12+
"ms.reviewer": ""
13+
} -->
14+
15+
When a nonadmin user calls the [Create group](/graph/api/group-post-groups) API, [Update group](/graph/api/group-update) API, or [Upsert group](/graph/api/group-upsert) API and adds their user ID in the request body in the **owners@odata.bind** collection, the request fails with a `400 Bad Request` error code with the message "Request contains a property with duplicate values." A nonadmin user can't explicitly add themselves as the group owner.
16+
17+
#### Workaround
18+
19+
There's no workaround for this error.
20+
21+
By default, a nonadmin user who is creating a security or Microsoft 365 group through the [Create group](/graph/api/group-post-groups) API or [Upsert group](/graph/api/group-upsert) API is automatically added to the **owners** collection of the group, if they don't specify any group owners. If they specify others as group owners, the nonadmin group creator is still automatically added to the **owners** collection of the security group, but not for the Microsoft 365 group. The user still can't add themselves to the **owners** collection during group update.
22+
23+
### GET /groups/{id}/members doesn't return service principals in v1.0
24+
25+
<!-- {
26+
"ms.author": "mbhargav",
27+
"ms.reviewer": ""
28+
} -->
29+
30+
The [List group members](/graph/api/group-list-members) API operation on the v1.0 endpoint currently doesn't return any service principals that might be members of the queried group.
31+
32+
#### Workaround
33+
34+
As a workaround, use one of the following options:
35+
36+
- Use the [List group members](/graph/api/group-list-members?view=graph-rest-beta&preserve-view=true) API operation on the beta endpoint.
37+
- Use the `/groups/{id}?$expand=members` API operation.

‎concepts/includes/known-issues/identity-access.md‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
---
2+
author: ombongifaith
3+
ms.topic: include
4+
ms.date: 02/06/2026
5+
ms.localizationpriority: medium
6+
---
7+
8+
### Use of specific query parameters on /subscribedSkus and /domains doesn't return the expected results
9+
10+
<!-- {
11+
"ms.author": "tazkiaafra",
12+
"ms.reviewer": ""
13+
} -->
14+
15+
The following usage of query parameters that target **subscribedSkus** and **domain** entities might not return the expected results:
16+
17+
- Use of `$search` on both **subscribedSkus** or **domain** entities
18+
- Use of `$top` and `$filter` on the **domain** entity
19+
20+
Currently, these parameters are effectively ignored, and the queries don't return the expected results.
21+
22+
#### Workaround
23+
24+
To prevent any disruption to your business processes, we recommend that you modify your application code to remove usage of these query parameters from queries that target the **subscribedSkus** or **domain** entities and run the search, top, and filter on the client side.
25+
26+
### Configuring federated domains in delegated scenarios requires Directory.AccessAsUser.All permission
27+
28+
<!-- {
29+
"ms.author": "rahulnagraj",
30+
"ms.reviewer": ""
31+
} -->
32+
33+
The [Create internalDomainFederation](/graph/api/domain-post-federationconfiguration), [Update internalDomainFederation](/graph/api/internaldomainfederation-update), and [Delete internalDomainFederation](/graph/api/internaldomainfederation-delete) might require you to grant consent to the *Directory.AccessAsUser.All* permission. This requirement is a temporary workaround till we provide a more granular delegated permission for managing federated domains.
34+
35+
### Claims mapping policy might require consent to additional permissions
36+
37+
<!-- {
38+
"ms.author": "paulgarn",
39+
"ms.reviewer": ""
40+
} -->
41+
42+
The [claimsMappingPolicy](/graph/api/resources/claimsmappingpolicy) API might require consent to both the *Policy.Read.All* and *Policy.ReadWrite.ConditionalAccess* permissions for the `LIST /policies/claimsMappingPolicies` and `GET /policies/claimsMappingPolicies/{id}` methods, as follows:
43+
44+
- If no **claimsMappingPolicy** objects are available to retrieve in a LIST operation, either permission is sufficient to call this method.
45+
- If there are **claimsMappingPolicy** objects to retrieve, your app must consent to both permissions. If not, a `403 Forbidden` error is returned.
46+
47+
In the future, either permission will be sufficient to call both methods.
48+
49+
### Conditional access policy requires consent to additional permission
50+
51+
<!-- {
52+
"ms.author": "davidspo",
53+
"ms.reviewer": ""
54+
} -->
55+
56+
The [conditionalAccessPolicy](/graph/api/resources/conditionalaccesspolicy) API currently requires consent to the *Policy.Read.All* permission to call the POST and PATCH methods. In the future, the *Policy.ReadWrite.ConditionalAccess* permission will enable you to read policies from the directory.

‎concepts/includes/known-issues/json-batching.md‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
author: ombongifaith
3+
ms.topic: include
4+
ms.date: 02/06/2026
5+
ms.localizationpriority: medium
6+
---
7+
8+
### Request dependencies are limited
9+
10+
<!-- {
11+
"ms.author": "sriramd",
12+
"ms.reviewer": ""
13+
} -->
14+
15+
Individual requests can depend on other individual requests. Currently, requests can only depend on a single other request, and must follow one of these three patterns:
16+
17+
- **Parallel** - no individual request states a dependency in the **dependsOn** property.
18+
- **Serial** - all individual requests depend on the previous individual request.
19+
- **Same** - all individual requests that state a dependency in the **dependsOn** property, state the same dependency. Note: Requests made using this pattern will run sequentially.
20+
21+
As JSON batching matures, these limitations will be removed.

‎concepts/includes/known-issues/mail.md‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
---
2+
author: ombongifaith
3+
ms.topic: include
4+
ms.date: 02/25/2026
5+
ms.localizationpriority: medium
6+
---
7+
8+
### Delta calls to the messages API using immutable Ids
9+
10+
<!-- {
11+
"ms.author": "abhda",
12+
"ms.reviewer": ""
13+
} -->
14+
15+
When you make `/delta` calls to the messages API using immutable Ids in some cases (for example when a message moves out of a folder and is then moved back in), you might miss some change notifications.
16+
17+
### The comment parameter for creating a draft isn't part of the message body
18+
19+
<!-- {
20+
"ms.author": "abhda",
21+
"ms.reviewer": ""
22+
} -->
23+
24+
The **comment** parameter for creating a reply or forward draft ([createReply](/graph/api/message-createreply), [createReplyAll](/graph/api/message-createreplyall), [createForward](/graph/api/message-createforward)) isn't part of the body of the response message draft.

0 commit comments

Comments
 (0)