Why does Microsoft Graph /me/membersOf return null for all Fields but id?

Ante 20 Reputation points
2024-07-19T12:12:24.5566667+00:00

I'm trying to request all my groups via

https://graph.microsoft.com/v1.0/me/memberOf

My access token has the scope User.Read(and more).

I get the right groups in the response, but all fields in the group objects are null except for the id. I can see that the groups are the right groups because they have the right IDs. I want to get the group names at least.

Microsoft Graph
Microsoft Graph
A Microsoft programmability model that exposes REST APIs and client libraries to access data on Microsoft 365 services.
11,750 questions
0 comments
Accepted answer
  1. Vasil Michev 103K Reputation points MVP
    2024-07-19T17:30:48.9+00:00

    As explained in the documentation, the Graph API will return null values for attributes it does not have permissions to read:

    When an application queries a relationship that returns a directoryObject type collection, if it doesn't have permission to read a certain resource type, members of that type are returned but with limited information. For example, only the @odata.type property for the object type and the id is returned, while other properties are indicated as null. With this behavior, applications can request the least privileged permissions they need, rather than rely on the set of Directory.* permissions. For details, see Limited information returned for inaccessible member objects.

    If you want the full set of details, you will need to grant additional permissions, depending on the set of members. For best results, you want to cover both user and group objects, and depending on the goal, devices and service principals as well. For more details, refer to the link above: https://video2.skills-academy.com/en-us/graph/permissions-overview?tabs=http#limited-information-returned-for-inaccessible-member-objects

    1 person found this answer helpful.
    0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Andreas Baumgarten 107.3K Reputation points MVP
    2024-07-19T14:27:41.1166667+00:00

    Hi @Ante ,

    I haven't tested this but I think you need the permission Directory.Read.All as well to get the group details for the group membership of a user.

    If this doesn't work please try the scope user.read.all, group.read.all

    (If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

    Regards

    Andreas Baumgarten

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.