Response time from Microsoft Teams API access

[Robvil]

Hi

I requested access to the new teams api at Microsoft using their provided form at the 06-21-2022 and have not heard back yet from MS.
Have any of you requested access, and if so, what was the response time from Microsoft?

Regards
Robert

[Polina]

Hi Robert,

From what we know, it usually takes up to 2 weeks to get the approval, but apparently, the waiting time might be even longer.
Frankly speaking, I think that they are now overloaded with requests...

[Mildur]

Hi Robert

After reading Microsoft's docs, probably you won't get a mail notification.
According to the docs, you would have to use GraphAPI to verify if the API access was granted.

https://docs.microsoft.com/en-us/graph/ ... ected-apis

To verify whether your request has been approved, test your application access on the next applicable Monday. If we have additional questions about the request, we will contact the email specified in the form.

Thanks
Fabian

[KiwiBruce]

But how to test your application access?
Do we have to install the 6a (?) upgrade and hope it works?

[Mildur]

We will discuss it internally. I have an idea, but need to check it first.

Thanks
Fabian

[Robvil]

Thank you.

[Mildur]

Hi Robert

I have put together some commands. The output is not optimized. I'll check if I can optimize the output, but to verify if you have access, the commands will work. Let me know if it works in your environment.

Requirements
You must provide the following information:

• TenantId = Your Tenant ID

• AppId = Your VB365 App ID. API Permission ChannelMessage.Read.All must be assigned in AzureAD

• CertThumbprint = Thumbprint from the VB365 Authentication certificate. You can find it in VB365, windows cert manager or in the app configuration in your Azure AD admin console.

The commands must be run directly on your VB365 Server in an evaluated PowerShell session and the Microsoft Graph PowerShell SDK must be installed. This commands doesn't require the subscription, because they are only listing messages and not downloading them.

Commands

Code: Select all

#Configuration
$TenantId = "Your Tenant ID"
$AppId = "Your VB365 App ID"
$CertThumbprint = "Thumbprint from the VB365 Authentification certificate"

#Connect to GraphAPI
$Cert=Get-ChildItem Cert:\LocalMachine\My\$CertThumbprint
Connect-MgGraph -AppId $AppId -TenantId $TenantId -Certificate $Cert

#Get all M365 group (unified group) and use the ID to query a list of messages for a single team (second one, first one is the default group without a team attached)
$Teams = Get-MgGroup -Filter "groupTypes/any(c:c eq 'Unified')" | select id
Get-MgTeamChannelMessage -TeamID $Teams.Id[1]

Access has been granted
If your App have been granted access to the protected API's, the command will either show you an empty line because the first Teams has no messages or it will list the available messages. If you want to check other teams, you can use Get-MgGroup to get the ID of the Team and us this ID in Get-MgTeamChannelMessage to query the messages.


Access has not been granted yet
If you don't have access to the protected API's, you will see the following error as documented in our KB:

[Robvil]

Thank you.

I can see, i do not have access yet.

Welcome To Microsoft Graph!
Get-MgTeamChannelMessage : UnknownError
At C:\Users\admin-rv\Desktop\Check access to Teams API.ps1:9 char:1
+ Get-MgTeamChannelMessage -TeamID $Teams.Id
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: ({ TeamId = 0adb...-fab901e741be }:<>f__AnonymousType7`1) [Get-MgTeamC
hannelMessage_Get3], RestException`1
+ FullyQualifiedErrorId : NotFound,Microsoft.Graph.PowerShell.Cmdlets.GetMgTeamChannelMessage_Get3

[Mildur]

Hi Robert

The output "Get-MgTeamChannelMessage : UnknownError" doesn't look the same as in my example. Can you run the commands one by one in a power shell session?
Probably there is some issue in the Get-MgGroup | select id -First 1 command. Do you see the Groups if you use the command after you have connected to Microsoft Graph.

You should see the following message if you are blocked from using the API:

Get-MgTeamChannelMessage : Invoked API requires Protected API access in application-only context when not using
Resource Specific Consent. Visit https://docs.microsoft.com/en-us/graph/ ... ected-apis for more details.

[Robvil]

You are right.

Code: Select all

Welcome To Microsoft Graph!
PS C:\WINDOWS\system32> $Teams = Get-MgGroup | select id -First 1
PS C:\WINDOWS\system32> Get-MgTeamChannelMessage -TeamID $Teams.Id
Get-MgTeamChannelMessage : UnknownError
At line:1 char:1
+ Get-MgTeamChannelMessage -TeamID $Teams.Id
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: ({ TeamId = 0adb...-fab901e741be }:<>f__AnonymousType7`1) [Get-MgTeamC
   hannelMessage_Get3], RestException`1
    + FullyQualifiedErrorId : NotFound,Microsoft.Graph.PowerShell.Cmdlets.GetMgTeamChannelMessage_Get3

PS C:\WINDOWS\system32> Get-MgGroup | select id -First 1

Id
--
0adb5665-b3a1-461c-a562-fab901e741be


PS C:\WINDOWS\system32> Get-MgGroup | select id -First 5

Id
--
0adb5665-b3a1-461c-a562-fab901e741be
0ef6ee68-387d-40eb-aa03-3b5c9b70774b
12626729-9a72-4361-b328-9e51ffb29a82
141ebfb9-d704-42a8-bcd6-4e39c6c242b1
2168a895-831e-4f4d-9df4-43d9ffabaffa

So i have access.

[Mildur]

Get-MgGroup is not a protected API. But it's good to see, that the Teams group can be queried.

We need to test it with Get-MgTeamChannelMessage, which is a protected API.
Can you try this command with a random value?

Get-MgTeamChannelMessage -TeamID 46464654654654654

And please make sure, that you have added the required permission to the App in AzureAD:

Code: Select all

ChannelMessage.Read.All

[Robvil]

Using a fiktive valid GUID throughs InvalidOperation

Code: Select all

PS C:\Users\admin-rv\Desktop> Get-MgTeamChannelMessage -TeamID 512856435165486485
Get-MgTeamChannelMessage : teamId needs to be a valid GUID.
At line:1 char:1
+ Get-MgTeamChannelMessage -TeamID 512856435165486485
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: ({ TeamId = 512856435165486485 }:<>f__AnonymousType7`1) [Get-MgTeamCha
   nnelMessage_Get3], RestException`1
    + FullyQualifiedErrorId : BadRequest,Microsoft.Graph.PowerShell.Cmdlets.GetMgTeamChannelMessage_Get3
PS C:\Users\admin-rv\Desktop> Get-MgTeamChannelMessage -TeamID 38ed0365-8891-4d56-82f1-102256a927d9
Get-MgTeamChannelMessage : UnknownError
At line:1 char:1


+ Get-MgTeamChannelMessage -TeamID 38ed0365-8891-4d56-82f1-102256a927d9
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: ({ TeamId = 38ed...-102256a927d9 }:<>f__AnonymousType7`1) [Get-MgTeamC
   hannelMessage_Get3], RestException`1
    + FullyQualifiedErrorId : NotFound,Microsoft.Graph.PowerShell.Cmdlets.GetMgTeamChannelMessage_Get3

[Robvil]

PS C:\Users\admin-rv\Desktop> Get-MgGroup | select id -First 1

Code: Select all

Id
--
0adb5665-b3a1-461c-a562-fab901e741be


PS C:\Users\admin-rv\Desktop> Get-MgTeamChannelMessage -TeamID 0adb5665-b3a1-461c-a562-fab901e741be
Get-MgTeamChannelMessage : UnknownError
At line:1 char:1
+ Get-MgTeamChannelMessage -TeamID 0adb5665-b3a1-461c-a562-fab901e741be
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: ({ TeamId = 0adb...-fab901e741be }:<>f__AnonymousType7`1) [Get-MgTeamC
   hannelMessage_Get3], RestException`1
    + FullyQualifiedErrorId : NotFound,Microsoft.Graph.PowerShell.Cmdlets.GetMgTeamChannelMessage_Get3

[Mildur]

Using a fiktive valid GUID throughs InvalidOperation

This one looks good to me. It says that the GUID is wrong. But the command works. So you can query the API.
The other message "Unknown" seems strange to me. Could be another unrelated issue.

If you have given the APP the permission ChannelMessage.Read.All, then it seems to me that access to the protected API has been granted. If not, you would have received the API notification from my screenshot even with the wrong fictive GUID.

[mrowell]

I think the "Get-MgTeamChannelMessage : UnknownError" error is because "Get-MgGroup" returns All Groups and not just those that are associated with a Team.

I ran "Get-MgGroup" by itself and it was the 5th returned ID that worked with "Get-MgTeamChannelMessage -TeamID"

[Mildur]

Thanks Marcus.
That makes sense.

[Robvil]

Looks as @mrowell are right:

Get-MgTeamChannelMessage -TeamID 5c2df604-1539-4ddc-b220-b8fb06421e4c

Id ChatId CreatedDateTime DeletedDateTime Etag Importance LastEditedDateTime LastModifiedDateTime Locale MessageType ReplyToId Subj
ect
-- ------ --------------- --------------- ---- ---------- ------------------ -------------------- ------ ----------- --------- ----
1615799453693 15-03-2021 09:10:53 1615799453693 normal 15-03-2021 09:10:53 en-us message
1615799351341 15-03-2021 09:09:11 1615799351341 normal 15-03-2021 09:09:11 en-us message
1611757998118 27-01-2021 14:33:18 1611757998118 normal 27-01-2021 14:33:18 en-us message

[Mildur]

Thanks.
I updated the commands to only list M365 Groups (Unified Groups).