microsoftgraph / microsoftgraph/msgraph-sdk-dotnet

EdiscoveryCaseMember API requires ediscovery.read.all permission, causing 401 Unauthorized errors

Open
#3,091 7 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Needs: Attention :wave:
Dominant language
C#
Stars
789
Forks
264
Avg merge
15h 17m
Merged PRs (30d)
3

Description

Describe the bug

When attempting to retrieve case members from the eDiscovery Security API endpoint https://graph.microsoft.com/v1.0/security/cases/ediscoveryCases/[caseId]/caseMembers using the Microsoft Graph .NET SDK, the API returns a 401 Unauthorized response even when the application has the correct permissions.

Problem:
The CaseMembers.GetAsync() endpoint on an eDiscovery case requires the ediscovery.read.all permission, but the permission validation appears to be rejecting the request despite the permission being granted. This forces applications to catch and suppress the 401 error, leaving case member data unavailable. Documentation suggests this should be supported - https://learn.microsoft.com/en-us/graph/api/security-ediscoverycasemember-list?view=graph-rest-1.0&tabs=http#permissions

Expected behavior

The API should return a 200 OK response with the list of case members when the application has the ediscovery.read.all permission granted.

How to reproduce

Steps to Reproduce:

  • Register an application in Azure Entra with ediscovery.read.all permission granted (both delegated and app-only scopes).
  • Authenticate with WithAppOnly() option
  • Call the CaseMembers.GetAsync()] method on a case:
  • Observe: 401 Unauthorized response is received
try
{
    var page = await GraphClient.Security
        .Cases
        .EdiscoveryCases[caseId]
        .CaseMembers.GetAsync(r => r.Options.WithAppOnly(), cancellationToken);
}
catch (Microsoft.Graph.Models.ODataErrors.ODataError e) 
    when (e.ResponseStatusCode == (int)System.Net.HttpStatusCode.Unauthorized)
{
    throw
}
SDK Version

5.103.0 / latest - this has happened since feature was released

Latest version known to work for scenario above?

No response

Known Workarounds

Delegated permissions, but that's generally not a viable options for headless applications.

Debug output
Click to expand log ```
</details>


### Configuration

N/A

### Other information

This appears to be either:

* A bug in the Microsoft Graph API permission validation for the `CaseMembers` endpoint
* An SDK issue where the permission requirement is not being correctly communicated to the Graph API

Please clarify the correct permission requirement or fix the endpoint's permission validation.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the request through Microsoft Graph's eDiscovery caseMembers endpoint using the SDK entry point CaseMembers.GetAsync() with WithAppOnly(). Compare the granted ediscovery.read.all permission and the API's response to determine whether the failure is in the SDK request or Graph permission validation; done means a 200 OK response with case member data for app-only authentication.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
api, authorization
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.