Microsoft Graph To Do attachments return 401 with Tasks.Read on personal account

Subject: Microsoft Graph To Do attachment GET returns 401 with delegated Tasks.Read on personal Microsoft account

Microsoft Graph v1.0 returns HTTP 401 Unauthorized when listing attachments on Microsoft To Do tasks belonging to a personal Microsoft account. approximate failure time, October 20, 2026, around 04:42 EDT

Expected behaviour: According to Microsoft's documentation for List taskFileAttachments, delegated Tasks.Read is sufficient for personal Microsoft accounts.

Observed behaviour:

• GET /me/todo/lists: 200 OK

GET /me/todo/lists/{listId}/tasks: 200 OK

GET /me/todo/lists/{listId}/tasks/{taskId}: 200 OK

GET /me/todo/lists/{listId}/tasks/{taskId}/checklistItems: 200 OK

GET /me/todo/lists/{listId}/tasks/{taskId}/attachments: 401 Unauthorized

The attachment failure reproduces across at least four separate To Do lists and in both Microsoft Graph PowerShell and Microsoft Graph Explorer.

The account has consented to the delegated Tasks.Read permission. No write permissions have been granted.

Graph Explorer failed request:

HTTP status: 401 Unauthorized

Client request ID: 03254da1-45af-306e-3e38-231eb2f35d48

Request ID: 05897d91-14d8-4ab5-8461-e838d054ec9c

Please investigate whether this is a service-side authorization defect, an undocumented limitation affecting personal accounts, or a discrepancy in the API permission documentation.

No task creation, deletion or modification is needed to reproduce the issue.Subject: Microsoft Graph To Do attachment GET returns 401 with delegated Tasks.Read on personal Microsoft account

Microsoft Graph v1.0 returns HTTP 401 Unauthorized when listing attachments on Microsoft To Do tasks belonging to a personal Microsoft account.

Expected behaviour: According to Microsoft's documentation for List taskFileAttachments, delegated Tasks.Read is sufficient for personal Microsoft accounts.

Observed behaviour:

GET /me/todo/lists: 200 OK

GET /me/todo/lists/{listId}/tasks: 200 OK

GET /me/todo/lists/{listId}/tasks/{taskId}: 200 OK

GET /me/todo/lists/{listId}/tasks/{taskId}/checklistItems: 200 OK

GET /me/todo/lists/{listId}/tasks/{taskId}/attachments: 401 Unauthorized

The attachment failure reproduces across at least four separate To Do lists and in both Microsoft Graph PowerShell and Microsoft Graph Explorer.

The account has consented to the delegated Tasks.Read permission. No write permissions have been granted.

Graph Explorer failed request:

HTTP status: 401 Unauthorized

Client request ID: 03254da1-45af-306e-3e38-231eb2f35d48

Request ID: 05897d91-14d8-4ab5-8461-e838d054ec9c

Please investigate whether this is a service-side authorization defect, an undocumented limitation affecting personal accounts, or a discrepancy in the API permission documentation.

No task creation, deletion or modification is needed to reproduce the issue.