Maintain control of your Microsoft 365 data
Post Reply
sumeet
Service Provider
Posts: 125
Liked: 20 times
Joined: Apr 23, 2021 6:40 am
Full Name: Sumeet P
Contact:

Email from Teams Graph Protected API

Post by sumeet »

Hello all,

Last night received this email from Teams Graph Protected API.
Has others too received such an email?

I followed the steps provided by Veeam in the following two KBs Same is what we communicated with our clients and our backups have been working fine (except for one client who did not perform these steps in Jan/Feb 2023).
Based on the below email it now make sense that this client is having issues with Error 402 due to the new requirements.

So all the changes that we did in Jan/Feb 2023 are setup to use evaluation mode and we still need to follow the steps in the link https://learn.microsoft.com/en-gb/graph ... -api-setup and https://learn.microsoft.com/en-gb/graph/teams-licenses

Is this true? Can someone from Veeam Management confirm this?
What have others using Teams backup received such an email?

===============================

Thank you for using Microsoft Teams APIs on Microsoft Graph. In October 2021 and June 2022, we announced specific licensing and payment requirements for these metered APIs.

If your application requires more than the Evaluation Mode's seeded capacity of 500 messages per month, it must use model=A or B (not evaluation mode) and have active Azure billing subscriptions set up.

Existing applications that used these metered APIs in February 2023 were given a grace period from these requirements but must now set up an active Azure billing subscription by June 30th, 2023 to avoid service disruptions. All other applications, including any new applications since March 1st, 2023, are already subject to these requirements. (GCC tenants are currently exempt from these requirements.)

Applications without an active Azure subscription will get “Error 402” (payment required) when trying to access the metered APIs using model=A or model=B. Applications using Evaluation Mode and exceeding the evaluation seeded capacity will also get “Error 402”, prompting you to use model=A or model=B instead.

To avoid service disruptions to your application(s), please take the following actions if you haven’t done so yet:

• Set up an Azure billing subscription for each application. https://learn.microsoft.com/en-gb/graph ... -api-setup
• Set up a payment model (model=A or model=B) for each API request of a metered API. https://learn.microsoft.com/en-gb/graph/teams-licenses
• If your app is using model=A, ensure that your users have the proper E5 licenses and that DLP is enabled.

Please note that even if you have previously provided a subscription ID in the Protected API form, in order for the Azure subscription to be properly configured, you still need to follow the instructions above to finish the setup.

For detailed information on seeded capacity and consumption fees, please review licensing and payment requirements for Microsoft Graph Teams APIs. On this page, you’ll also learn how to estimate and monitor the costs for these metered APIs. Once your Azure subscription is properly configured, you should be able to see and monitor the costs using Cost Analysis within your Azure portal within about one week.

If you have questions about this notification, please reach out to https://developer.microsoft.com/graph/support. Please do not reply to this email, as it is not monitored.

Your application ID(s): XXXXX-XXXX-XXXXX

Thank you for using Microsoft Teams!

====================================
HannesK
Product Manager
Posts: 14402
Liked: 2909 times
Joined: Sep 01, 2014 11:46 am
Full Name: Hannes Kasparick
Location: Austria
Contact:

Re: Email from Teams Graph Protected API

Post by HannesK »

Hello,
Has others too received such an email?
for sure... I just searched the internet and found for example this customer
Is this true? Can someone from Veeam Management confirm this?
What have others using Teams backup received such an email?
yes, you have to pay for Teams backup. That's what the email and our KB articles confirm.

Best regards,
Hannes
Regnor
VeeaMVP
Posts: 957
Liked: 296 times
Joined: Jan 31, 2011 11:17 am
Full Name: Max
Contact:

Re: Email from Teams Graph Protected API

Post by Regnor »

The process did indeed change and you now have to manually connect the subscription with the application.
This is described in KB4322 in 3.
Also I would suggest that you take a look at this blog post as it helped me setting it up via CLI: https://1111systems.com/blog/the-saga-c ... xport-api/
Mike Resseler
Product Manager
Posts: 8048
Liked: 1264 times
Joined: Feb 08, 2013 3:08 pm
Full Name: Mike Resseler
Location: Belgium
Contact:

Re: Email from Teams Graph Protected API

Post by Mike Resseler »

I can not confirm 100 percent yet, but it seems everybody that uses the API's have received that specific email. We are looking into it, because as far as I know, the subscriptions we use to develop on have this feature enabled and we are paying already for it, so it might be simply a message to everyone. But as said, we are looking into it.
sumeet
Service Provider
Posts: 125
Liked: 20 times
Joined: Apr 23, 2021 6:40 am
Full Name: Sumeet P
Contact:

Re: Email from Teams Graph Protected API

Post by sumeet »

Thanks Regnor,
Had not seen the step 3 in KB4322. Must have been added in the last 3-4 weeks.

The steps we have done are to request Microsoft to enable the new Teams API, once we get the email confirmation that the API is enabled, perform steps on the VBO server to use the new API.
But as mentioned, one of the clients for whom we are getting error, we will try the step 3 and hopefully it works.

Thanks Mike.
I feel we need some steps to confirm what is the setup configured as. The evaluation mode mentioned in the email concerns me. If there is a way to confirm what has been setup for Teams API, by following the two KB articles (except the step 3 in KB4322)
Polina
Veeam Software
Posts: 3014
Liked: 714 times
Joined: Oct 21, 2011 11:22 am
Full Name: Polina Vasileva
Contact:

Re: Email from Teams Graph Protected API

Post by Polina »

Hi Sumeet,

The KB has been updated with step 3 about a month ago; soon after the subscription has become a mandatory requirement.

Currently, there's no way to check if the APIs were enabled, and I believe you'll get the confirmation from Microsoft after you add a subscription.
dotdk
Service Provider
Posts: 32
Liked: 12 times
Joined: Jun 14, 2019 11:55 am
Full Name: Thomas Lund
Contact:

Re: Email from Teams Graph Protected API

Post by dotdk »

sumeet wrote: Apr 13, 2023 12:28 am I feel we need some steps to confirm what is the setup configured as. The evaluation mode mentioned in the email concerns me. If there is a way to confirm what has been setup for Teams API, by following the two KB articles (except the step 3 in KB4322)
Hi Sumeet

Maybe this is what you are looking for in order verify access to the API: veeam-backup-for-microsoft-365-f47/prot ... 84923.html
We had the same issue and was able to verify access with the script from https://community.veeam.com/script-libr ... s-api-2931
sumeet
Service Provider
Posts: 125
Liked: 20 times
Joined: Apr 23, 2021 6:40 am
Full Name: Sumeet P
Contact:

Re: Email from Teams Graph Protected API

Post by sumeet »

Thank you all for your assistance.

After performing steps 2 and 3 from this link -- https://learn.microsoft.com/en-gb/graph ... -api-setup
We got the backups working for the client who requested access to Teams export API form and got a confirmation email from Microsoft in third week of May.

For our own backup and all of our clients that we changed to use the new Teams export API in Jan end, we only had to use Teams export API form to request access and once we got a confirmation email from MSFT that the API is enabled, we did the steps on the VBM server and enabled teams chat backup. We did not run these two additional steps.

But reading the blog post provided by Regnor, it makes sense that the Teams export API request form no longer asks for the subscription ID and instead these two steps (https://learn.microsoft.com/en-gb/graph ... -api-setup) have to be used to link with subscription ID.

Now I have the following questions:
1. The change to use the new Teams export API that we did in JAN end or in Nov 2022, will they continue to work fine? Currently the backups are working fine with Teams chat option enabled. But is any additional change required. The reason I ask is in the email sent by MSFT that I have pasted in my first msg. Also in the email they have called out evaluation mode (Applications using Evaluation Mode and exceeding the evaluation seeded capacity will also get “Error 402”, prompting you to use model=A or model=B instead.), what is this evaluation mode? Will the ones that we changed to using just the teams request form were default to evaluation mode? How can we check what mode is the application using?

2. I checked the Microsoft M365/Azure bill that our organization receives. I do not see any entry for Teams export API. There are entries for Azure plans that we are using, but no specific entry for API. Does anyone else see a separate entry for Teams export API in their bill? If missing entry, would it mean that we are on evaluation mode?

Thanks,
-Sumeet.
sumeet
Service Provider
Posts: 125
Liked: 20 times
Joined: Apr 23, 2021 6:40 am
Full Name: Sumeet P
Contact:

Re: Email from Teams Graph Protected API

Post by sumeet »

Hello all,

Many of our clients are reaching out to us, forwarding the email (that I have pasted in my first post) they have received and asking if any action is required.

The email has - Please note that even if you have previously provided a subscription ID in the Protected API form, in order for the Azure subscription to be properly configured, you still need to follow the instructions above to finish the setup.

Hence it means that we have to finish the setup as back in Jan 2023 the protected API form did have the option to provide Azure subscription ID.

The first step - Set up an Azure billing subscription for each application - seems clear, but unsure of the second step about the payment model.
Since we already have M365 licenses and Azure subscription, is billing exists.

Also, I did the steps in this link https://learn.microsoft.com/en-gb/graph ... teams-apis
to view the costs for the metered teams api, but when I filter on service name, Microsoft Graph Service does not get listed. Strange.
Will be helpful if others can confirm what do they find when they filter.

Further more details from others or Veeam will be helpful on what they make out of this email from MSFT.

Thanks,
-Sumeet.
Polina
Veeam Software
Posts: 3014
Liked: 714 times
Joined: Oct 21, 2011 11:22 am
Full Name: Polina Vasileva
Contact:

Re: Email from Teams Graph Protected API

Post by Polina »

Hi Sumeet,

For dev and testing purposes, we're using specific accounts and subscriptions, and atm I can't say much about the emails that you receive. I believe that the challenge will be resolved once you provide the required subscription, but I'll try to get more information.

VB365 uses model B by default which is approved and recommended by Microsoft.

Thanks!
johan.h
Veeam Software
Posts: 714
Liked: 184 times
Joined: Jun 05, 2013 9:45 am
Full Name: Johan Huttenga
Contact:

Re: Email from Teams Graph Protected API

Post by johan.h » 1 person likes this post

We updated KB4322 as we learned that Microsoft changed the on-boarding process. Initially the subscription id was part of the on-boarding form for protected APIs. They stated they wanted to improve this process so it can be made easier in the future. I'm told everyone needs to follow the new process, even people that followed a different process previously.

If you got this email I would be sure you've followed these steps here: https://learn.microsoft.com/en-us/graph ... -api-setup.

To clarify - This process does not feel easier, however the intent for the future is to add a front-end to this experience from within an Azure subscription and go beyond this with integration options to reduce the amount of steps an end-user has to take. So this could be seen as a first attempt to streamline all of this.

The billing page would feel like a natural place to look to see if this is configured correctly, however the M365 development tenant I personally have to check this cannot be linked to an Azure subscription - so I cannot quickly validate this at the moment. I'll be following up with the Microsoft team responsible today and post any updates I have here.
Robvil
Expert
Posts: 172
Liked: 20 times
Joined: Oct 03, 2016 12:41 pm
Full Name: Robert
Contact:

Re: Email from Teams Graph Protected API

Post by Robvil »

I find it a bit confusing. I had to setup new Azure subscription, pay-as-you-go, and did the powershell setup Microsoft is referring to. I called my resource group Teams-api-RG, but when i look into this RG, there are no values is Cost analysis section.

Only cost analysis i find, is the cost for my Cloud Shell Storage going at dkk 0.09 :)

/Robert
sumeet
Service Provider
Posts: 125
Liked: 20 times
Joined: Apr 23, 2021 6:40 am
Full Name: Sumeet P
Contact:

Re: Email from Teams Graph Protected API

Post by sumeet »

Hello all,

Appreciate all the responses. This is helpful.
I understand that our own backup and clients who we switched to the new Teams export API in Jan this year, are in evaluation mode and need to perform two additional steps as given here https://learn.microsoft.com/en-us/graph ... -api-setup

I have received another email from MSFT today, reminder for the June 30th deadline for this API.
But this email has additional information as compared to what I received in April. It mentions about -- ‘Microsoft Communications DLP’ service plan needs to be enabled for users
I have pasted the snippet below from the email.

==========
Licensing Enforcement:

Users must be appropriately licensed for their data to be extracted out of Teams via Security & Compliance (S&C) applications. Applications trying to access user data without proper license will return HTTP Status Code 402 (payment required). Security & Compliance (S&C) applications calling the APIs must use model=A.

Along with an appropriate license, ‘Microsoft Communications DLP’ service plan needs to be enabled for users. This can be done via Microsoft 365 admin center.
==========

It looks like, Microsoft seems to be figuring out all the information that it requires in a phased manner and keeps adding to the confusion by updating each email communication they send.

-Sumeet.
Robvil
Expert
Posts: 172
Liked: 20 times
Joined: Oct 03, 2016 12:41 pm
Full Name: Robert
Contact:

Re: Email from Teams Graph Protected API

Post by Robvil »

Hi Sumeet

My first email from MS did also include this information. Veeam uses model B for Teams backup.
... model=B is restricted to applications that do not perform a security or compliance function = No E5 or DLP license needed.

... model=A The user will need a license that supports the Microsoft Communications DLP.

https://www.veeam.com/kb4322
https://learn.microsoft.com/en-us/graph ... quirements

/Robert
Mike Resseler
Product Manager
Posts: 8048
Liked: 1264 times
Joined: Feb 08, 2013 3:08 pm
Full Name: Mike Resseler
Location: Belgium
Contact:

Re: Email from Teams Graph Protected API

Post by Mike Resseler »

As an addition to the great information from Robert above... We need to use model=B from MSFT. We have been trying to allow a customer to use model=A when they have the possibility but they state it is not for security reasons so we need model B
sumeet
Service Provider
Posts: 125
Liked: 20 times
Joined: Apr 23, 2021 6:40 am
Full Name: Sumeet P
Contact:

Re: Email from Teams Graph Protected API

Post by sumeet »

Hi Robert, Mike,

Sorry, my bad, I should have called what I was pointing too.
I was referring too the -- ‘Microsoft Communications DLP’ service plan needs to be enabled for users
This is new and was not informed earlier.

Thanks,
-Sumeet.
Mike Resseler
Product Manager
Posts: 8048
Liked: 1264 times
Joined: Feb 08, 2013 3:08 pm
Full Name: Mike Resseler
Location: Belgium
Contact:

Re: Email from Teams Graph Protected API

Post by Mike Resseler »

Hey Sumeet, Robert.

To be honest, I don't like what is happening at this point in time with this API and the effort everybody has to do to get it activated. (Funny enough suddenly there are many organizations now not interested anymore in Teams Chat backup where they were before :-)). As we are in constant conversation with the teams at Microsoft, we know that they are working on improving all of these items above, but as always in software, this can't be fixed in a few weeks. Hopefully lots of lessons are learned from this and we have better experiences with a next set of paid API's (which I am pretty certain they will come...)
johan.h
Veeam Software
Posts: 714
Liked: 184 times
Joined: Jun 05, 2013 9:45 am
Full Name: Johan Huttenga
Contact:

Re: Email from Teams Graph Protected API

Post by johan.h »

Just a little bit of additional information, I'm told Microsoft is working to get rid of, or at least reduce the work required for "Step 2: Request API Access", as the act of linking an app registration to a billing subscription would likely be enough. Hopefully this change goes through in the next few weeks.
johan.h
Veeam Software
Posts: 714
Liked: 184 times
Joined: Jun 05, 2013 9:45 am
Full Name: Johan Huttenga
Contact:

Re: Email from Teams Graph Protected API

Post by johan.h »

These changes went live yesterday. We'll be updating KB4322 to reflect these changes.

Starting May 18th, 2023, the online form and the protected API approval process are no longer needed. You can immediately call the protected APIs as long as other requirements (app registration (https://learn.microsoft.com/azure/activ ... gister-app) and subscription association (https://learn.microsoft.com/graph/metered-api-setup)) are met.
joann.salomon
Lurker
Posts: 2
Liked: never
Joined: Aug 30, 2023 9:03 am
Full Name: Joann Salomon
Contact:

Re: Email from Teams Graph Protected API

Post by joann.salomon »

In addition to the "Error 402" message, encountering this payment requirement error could potentially disrupt critical operations for applications relying on Microsoft Teams APIs. This change underscores the importance of ensuring your application's compliance with b2b API integration and the new licensing and billing requirements promptly.

Developers and organizations must proactively address these new measures to prevent any unexpected service interruptions or downtime. Furthermore, understanding the intricacies of Azure billing and payment models is crucial for accurately estimating and managing costs associated with API usage, ensuring efficient resource allocation within your organization.

To maintain uninterrupted access to Microsoft Teams APIs and seamlessly integrate them into your applications, it's imperative to stay informed about any further updates or modifications to these licensing and payment requirements in the future.
lauryfriese
Novice
Posts: 3
Liked: never
Joined: Dec 04, 2023 9:38 am
Full Name: laury friese
Contact:

Re: Email from Teams Graph Protected API

Post by lauryfriese »

I don't like what's happening at the moment with this API and the effort people have to put in to enable it.
Mildur
Product Manager
Posts: 8913
Liked: 2357 times
Joined: May 13, 2017 4:51 pm
Full Name: Fabian K.
Location: Switzerland
Contact:

Re: Email from Teams Graph Protected API

Post by Mildur »

Hello Laury

Could you maybe share what you mean with "happening at the moment"?
I checked the steps. They didn't changed the last few months:

1) Add your M365 organization with the VB365 backup console and autocreate the backup application (or manually if you want): https://helpcenter.veeam.com/docs/vbo36 ... -text-link
2) Create Azure subscription + Link the App to the subscription: https://www.veeam.com/kb4322

Best,
Fabian
Product Management Analyst @ Veeam Software
lauryfriese
Novice
Posts: 3
Liked: never
Joined: Dec 04, 2023 9:38 am
Full Name: laury friese
Contact:

Re: Email from Teams Graph Protected API

Post by lauryfriese »

Many organizations are no longer as concerned about backing up Group Chats as they once were. Drift Boss
Post Reply

Who is online

Users browsing this forum: No registered users and 18 guests