We are calling MS Graph API endpoints that require metered API to be enabled (e.g. assignSensitivityLabel). Microsoft.GraphServices/accounts resource for our app has been created according to documentation. Call is working fine when we use client credentials flow, but it returns 402 Payment Required error in case we use on-behalf-of flow.
In both flows we pass our app id as client_id and set scope to https://graph.microsoft.com/.default.
App token has following claims:
<code>{
"aud": "https://graph.microsoft.com/.default",
"iss": "https://sts.windows.net/{tenantId}/",
"idp": "https://sts.windows.net/{tenantId}/",
"appid": "{applicationId}",
"idtyp": "app",
"roles": [
"Sites.Selected",
"Sites.ReadWrite.All",
"Mail.Send"
],
"tid": "{tenandId}"
}
</code>
<code>{
"aud": "https://graph.microsoft.com/.default",
"iss": "https://sts.windows.net/{tenantId}/",
"idp": "https://sts.windows.net/{tenantId}/",
"appid": "{applicationId}",
"idtyp": "app",
"roles": [
"Sites.Selected",
"Sites.ReadWrite.All",
"Mail.Send"
],
"tid": "{tenandId}"
}
</code>
{
"aud": "https://graph.microsoft.com/.default",
"iss": "https://sts.windows.net/{tenantId}/",
"idp": "https://sts.windows.net/{tenantId}/",
"appid": "{applicationId}",
"idtyp": "app",
"roles": [
"Sites.Selected",
"Sites.ReadWrite.All",
"Mail.Send"
],
"tid": "{tenandId}"
}
User token:
<code>{
"aud": "https://graph.microsoft.com/.default",
"iss": "https://sts.windows.net/{tenantId}/",
"idp": "https://sts.windows.net/{tenantId}/",
"appid": "{applicationId}",
"idtyp": "user",
"scp": "Group.Read.All Sites.ReadWrite.All Sites.Selected User.Read User.Read.All profile openid email",
"tid": "{tenandId}"
}
</code>
<code>{
"aud": "https://graph.microsoft.com/.default",
"iss": "https://sts.windows.net/{tenantId}/",
"idp": "https://sts.windows.net/{tenantId}/",
"appid": "{applicationId}",
"idtyp": "user",
"scp": "Group.Read.All Sites.ReadWrite.All Sites.Selected User.Read User.Read.All profile openid email",
"tid": "{tenandId}"
}
</code>
{
"aud": "https://graph.microsoft.com/.default",
"iss": "https://sts.windows.net/{tenantId}/",
"idp": "https://sts.windows.net/{tenantId}/",
"appid": "{applicationId}",
"idtyp": "user",
"scp": "Group.Read.All Sites.ReadWrite.All Sites.Selected User.Read User.Read.All profile openid email",
"tid": "{tenandId}"
}
Error returned by assignSensitivityLabel endpoint when invoked with user JWT is:
<code>{
"error": {
"code": "paymentRequired",
"message": "Payment Required. Ensure that your application is able to call this premium API.For details see https://aka.ms/graph-metered-overview"
}
}
</code>
<code>{
"error": {
"code": "paymentRequired",
"message": "Payment Required. Ensure that your application is able to call this premium API.For details see https://aka.ms/graph-metered-overview"
}
}
</code>
{
"error": {
"code": "paymentRequired",
"message": "Payment Required. Ensure that your application is able to call this premium API.For details see https://aka.ms/graph-metered-overview"
}
}
Interesting that we are able to invoke https://{tenantId}.sharepoint.com/_api/v2.1/drives/{driveId}/items/{itemId}/setSensitivityLabel with user JWT that we specifically obtain for SharePoint API via on-behalf-of flow. That call doesn’t return any errors.
Any ideas how to get it working with on-behalf-of flow?
2
You must be using a public client. As per the docs, this is a metered API and quoting the Metered API Graph APIs Graph docs
The following limitations apply to metered APIs:
- Metered APIs and services in Microsoft Graph are currently available
only in the Microsoft global environment and not in national cloud
deployments, including Microsoft 365 GCC deployments accessed through
the worldwide Microsoft Graph endpoint. For details about national
clouds, see National cloud deployments. The target application must be a confidential client application (for example, web application, web API, or daemon/service). Public client applications (desktop and mobile applications) aren't supported.- Azure managed identities
aren’t supported to call metered APIs. For more information, see
Azure services that support managed identities.
I suggest you create a feature request for this on this link