Forum Discussion
Attempt to get list of Workspaces via REST API results in 401 Unauthorized.
I finally found the answer to this issue and wanted to document it here.
The issue is that you don't need to just add API Permissions to an App Registration. You need to also consent to each API Permission (scope) at a user or app level. Now, an admin can grant access for all users (which is what is mentioned by some answers here in this post), but I'm not an admin, so I couldn't do that. What I needed to do was consent as a user to the specific API permissions that I had added to my App Registration.
Unfortunately, I couldn't find a way to do this in the Azure AD interface. In fact, I only found one place anywhere that actually explained how to do this for a *user* (the admin-level consent was mentioned in numerous places). Here is an answer here which talks about the URL needed to grant user consent to an API permission: https://stackoverflow.com/questions/59282141/aadsts65001-the-user-or-administrator-has-not-consented-to-use-the-application
The URLs look like so:
https://login.microsoftonline.com/[Put your Tenant ID here]/oauth2/v2.0/authorize? client_id=[This is your Client ID from your App Registration] &response_type=code &redirect_uri=https://myapp.mycompany.com[This must be the Redirect URI you setup in your App Registration] &response_mode=query &scope=https://graph.microsoft.com/User.Read[This is the scope URL for the API Permission]
Once I (finally) found that example, I was able to piece together a URL to consent to the newly added Workspace API permissions and my code started working. You can find out the "scope" URL for each API permission (which you have to add to the end of the full URL above) by going to your App Registration and clicking on API Permissions and then clicking on any of the API permissions you've added. This will bring up a window which shows the URL for that API Permission.
Ok. When you added the new Scope to you app, perhaps it is not Admin Consented to the User that you are trying to use. Try this...
In Azure Active Directory
- Go to Users, Select your user
- Click Applications on the Left
- Click the Application in the list that has the new Scope you just added
- You will see an Assignment Detail screen... at the bottom, click View Granted Permissions
- You will see a Permissions & Content screen... Search the list to make sure the new scope is in the list granted to your user. If not, add it now and try again.
I think we're getting somewhere, but I still can't fix it.
When I click on View Granted Permissions I see a big button that says "Grant Admin consent for [My Company]" which, if I'm reading the description correctly, grants access to that app for all users, not just a specific user. So I don't want that.
Then below that I see a couple tabs: Admin consent and User constent.
The Admin tab is empty (no permissions have been granted by an admin), but when I go to the User consent tab, I see permissions granted to that user, but I only see "Read and write all datasets". I don't see "Read and write all Workspaces" even though I've added that permission to the app. And there's no "Add" button anywhere I can see to add new permissions. Isn't that permission added at the app level?
Finally found an answer to this (exceptionally poorly documented) process. See below.