"ArgumentNull" response in Azure web app

Describe the bug

We were asked to open this issue by Microsoft support. We have three identically configured Azure web apps (development, test, production). On development and production, calls to MS Graph fail.
The same code works on the test instance, and multiple development machines. We have verified that test is set up the same as development and production.

We originally logged an issue with MSAL (4989), but they said it would be a Graph issue since they have already created the token but Graph is not validating it.

Expected behavior

This is what is logged from the same call on localhost:
info: UnifiedSmartPortal.Networking.GraphLoggingHandler[0]
MSAL Request: Method: GET, RequestUri: 'https://graph.microsoft.com/v1.0/me?$select=companyName,department,displayName,employeeType,givenName,jobTitle,mail,manager,officeLocation,preferredName,userPrincipalName', Version: 1.1, Content: , Headers:
{
Accept: application/json
Authorization: Bearer ****
FeatureFlag: 00000003
Cache-Control: no-store, no-cache
User-Agent: kiota-dotnet/1.3.4
SdkVersion: graph-dotnet-core/3.1.6 (featureUsage=00000003; hostOS=Microsoft Windows NT 10.0.22631.0; hostArch=X64; runtimeEnvironment=.NET 8.0.10;)
client-request-id: 5f1ff492-4dfc-4077-8a59-37804945e114
}
MSAL Response: StatusCode: 200, ReasonPhrase: 'OK', Version: 1.1, Content: System.Net.Http.HttpConnectionResponseContent, Headers:
{
Cache-Control: max-age=0, private
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000
request-id: 3c5ddd01-1b4e-4dcb-8325-7727160e8aba
client-request-id: 5f1ff492-4dfc-4077-8a59-37804945e114
x-ms-ags-diagnostic: {"ServerInfo":{"DataCenter":"West US","Slice":"E","Ring":"4","ScaleUnit":"005","RoleInstance":"SJ1PEPF00001C68"}}
x-ms-resource-unit: 1
OData-Version: 4.0
Date: Wed, 06 Nov 2024 13:17:10 GMT
Content-Type: application/json;odata.metadata=minimal;odata.streaming=true;IEEE754Compatible=false;charset=utf-8
}

{"@odata.context":"https://graph.microsoft.com/v1.0/$metadata#users(companyName,department,displayName,employeeType,givenName,jobTitle,mail,manager,officeLocation,preferredName,userPrincipalName)/$entity","companyName":"CP AHS VIRTUAL","department":"IT Clinical System Architectur","displayName":"Groves, Greg","employeeType":null,"givenName":"Greg","jobTitle":"IT-EMR Data Engineer Senior I","mail":"**@AdventHealth.com","officeLocation":"ALTAMONTE SPRINGS","userPrincipalName":"@multihosp.net","preferredName":""}

How to reproduce

private static readonly string[] UserProps = new string[] { "companyName", "department", "displayName", "employeeType",
"givenName", "jobTitle", "mail", "manager", "officeLocation", "preferredName", "userPrincipalName" };

...
_logger.LogDebug("[CallMicrosoftGraph] Calling Microsoft Graph...");
userInfo = await _graphServiceClient.Me
.GetAsync((requestConfiguration) =>
{
requestConfiguration.QueryParameters.Select = UserProps;
});
}

As noted, this works locally and in one Azure web app instance, but not in two others.

SDK Version

Microsoft.Identity.Web.GraphServiceClient 3.31

Latest version known to work for scenario above?

Microsoft.Identity.Web.GraphServiceClient 3.31

Known Workarounds

No response

Debug output

</details>


### Configuration

Packages: Microsoft.Identity.Web 3.3.1, Microsoft.Identity.Web.GraphServiceClient 3.31, Microsoft.Kiota.Authentication.Azure 1.14.0
.Net 8.0.10
Azure web app is Windows
Development machines are Windows 11

### Other information

I am not really sure this is a Graph library issue, but Microsoft Support asked us to log it here as apparently it will facilitate them working with you on it.

thanks for your help,
Greg Groves
AdventHealth

Start at the _graphServiceClient.Me.GetAsync call and compare the failing and working Azure web app configurations, using the logged request and 401 ArgumentNull response. Review the listed Microsoft.Identity.Web, GraphServiceClient, and Kiota.Authentication.Azure versions and the UserProps selection. Done means identifying the configuration or request difference that explains the environment-specific failure, or documenting that it requires Graph service investigation.