Bookings API: app-only token gets 401, delegated works

Question

Bookings API: app-only token gets 401, delegated works

Martin Hinshelwood nkdAgility.com 100 MVP

I can't get the Bookings Graph API to work with application permissions.

I've registered a single-tenant app (90a8fdd1-6642-47de-af97-2d6da7369d21) with a certificate, granted it Bookings.ReadWrite.All as an application permission, and given admin consent. The token it gets is app-only, and the role is in it. Test-ApplicationAccessPolicy against the booking mailbox (******@nkdagility.com) returns Granted. We're on Business Premium.

Every call returns 401 Unauthorized with no detail, on both v1.0 and beta, even a plain GET of the business. I waited over 30 minutes after consent before the last test. Request IDs:

658c4142-ed1f-4e89-86e6-b7e975b05b16
747661cd-70f5-410c-ad2e-a9860344bac2
e55cdf83-0da1-4dce-8594-4a32e85a10d5

The same calls work fine when I sign in as myself; I'm a staff member and admin on that business.

What am I missing? Is there a setting on the business or the tenant that blocks app access?

#microsoft-graph-bookings

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Bookings.ReadWrite.All alone is not sufficient for this call pattern with app-only access.

For the Bookings business GET API, the documented least-privileged application permission is BookingsAppointment.ReadWrite.All. The API page for GET /solutions/bookingBusinesses/{id} lists:

Delegated: Bookings.Read.All as least privileged
Application: BookingsAppointment.ReadWrite.All as least privileged

A matching Microsoft Q&A resolution for this exact symptom states that an app using only Bookings.ReadWrite.All received unauthorized/server errors, and the fix was to also grant BookingsAppointment.ReadWrite.All application permission and confirm that role is present in the app-only token.

Action to take:

In Microsoft Entra admin center → App registrations → the app → API permissions.
Add Microsoft Graph → Application permissions → BookingsAppointment.ReadWrite.All.
Grant admin consent again.
Acquire a new app-only token and verify the token contains the roles claim for BookingsAppointment.ReadWrite.All.
Retry GET /solutions/bookingBusinesses/{id}.

What this means for the current behavior:

Delegated works because the endpoint supports delegated permissions and the signed-in user has access.
App-only fails because the token permission set does not match what this endpoint requires for application access.

The provided material does not show any tenant-level or booking-business setting that blocks app access in this scenario. The supported explanation in the available documentation is a permission mismatch between delegated and application access.