ChannelMessage.Read.All application permission returns 403 Forbidden

Question

ChannelMessage.Read.All application permission returns 403 Forbidden

yamauchi 0

Environment:

App: Azure Bot (client credentials flow)
Permission: ChannelMessage.Read.All (Application) - Admin consent granted
Channel: Standard channel in a Team
Bot is installed in the Team

Error:

403 Forbidden / code: "Forbidden" / message: "UnknownError"

API call:

GET /teams/{teamId}/channels/{channelId}/messages/{messageId}

All conditions appear to be met:

ChannelMessage.Read.All (Application) added and admin consent granted
teamId is Azure AD Group GUID (not thread ID)
Channel is a standard channel
Bot is installed in the Team

Does ChannelMessage.Read.All require additional Microsoft approval

beyond admin consent (Protected API)?

0 comments

Answer recommended by moderator

yamauchi 0

Hi @Teddie Dang

Thank you for your continued support throughout this thread.

I'm happy to report that the issue has been resolved.

Root cause: The 403 "UnknownError" was caused by a tenant mismatch — the Azure app registration was configured as single-tenant, while the Teams environment belonged to a different tenant. This prevented the app from authenticating correctly against the Microsoft Graph API, resulting in the 403 error even though ChannelMessage.Read.All and admin consent appeared to be correctly configured.

Resolution: We changed the app registration from single-tenant to multi-tenant in the Azure portal (Supported account types → "Accounts in any organizational directory"). After this change, the Graph API calls started returning 200 OK successfully.

I hope this helps anyone else who encounters the same 403 "UnknownError" despite having the correct permissions — a tenant mismatch can produce this error without any descriptive indication of the actual cause.

Thank you again for your assistance.

Teddie Dang 1,970 Reputation points Independent Advisor

2026-10-28T00:21:30.8366667+00:00

Hi @yamauchi

Thank you for sharing the resolution and root cause. The tenant mismatch is a useful finding, especially since the 403 UnknownError did not clearly identify the issue. This should help other developers troubleshooting similar Microsoft Graph issues.

1 additional answer

Your answer

Teddie Dang 1,970 Reputation points Independent Advisor

2026-10-28T00:21:30.8366667+00:00

Hi @yamauchi

Thank you for sharing the resolution and root cause. The tenant mismatch is a useful finding, especially since the 403 UnknownError did not clearly identify the issue. This should help other developers troubleshooting similar Microsoft Graph issues.

Answer 1

Teddie Dang 1,970 Independent Advisor

Hi @yamauchi

I tested this scenario in Postman using the client credentials flow and the ChannelMessage.Read.All (Application) permission, with admin consent granted.

I successfully received 200 OK from the following Microsoft Graph endpoints:

GET /teams/{teamId}/channels/{channelId}/messages

GET /teams/{teamId}/channels/{channelId}/messages/{messageId}

To list channels and obtain the Channel ID, I also temporarily added Channel.ReadBasic.All (Application) and granted admin consent. However, if you already know the Team ID, Channel ID, and Message ID, you do not need Channel.ReadBasic.All just to retrieve an individual message.

I was able to retrieve an individual message successfully in Postman without requiring a separate Protected API approval step in my test environment. This test does not establish whether additional approval requirements apply to other tenants or configurations.

I suggest testing the same individual-message endpoint in Postman using your app's client credentials flow and access token. If it returns 200 OK but your bot still receives 403 Forbidden, compare the bot's token, app registration, tenant, and actual Graph request with the successful Postman request to identify the difference.

yamauchi 0 Reputation points

2026-10-25T14:40:41.83+00:00

Thank you for testing. I confirmed the token contains ChannelMessage.Read.All,

but all message endpoints return 403 "UnknownError" (not a descriptive

permission error). This matches the Protected API behavior.

Did your test environment previously submit the Protected API request form

(https://aka.ms/teamsgraph/requestaccess)? That URL now redirects to Bing,

suggesting the form was discontinued.

How did you get approval for ChannelMessage.Read.All application permission

in your tenant?
Teddie Dang 1,970 Reputation points Independent Advisor

2026-10-26T01:05:13.0166667+00:00

Hi @yamauchi

I did not submit the Protected API request form for my test environment.

Have you tried testing the same endpoint in Postman using your app's client credentials flow and access token? If so, what result did you get? Did it return 200 OK or 403 Forbidden?

Based on my findings, no further action is needed regarding the old Protected API request form. The form appears to have been retired, and previous approvals associated with that process are no longer relevant.

Instead, verify that your app registration has the required application permissions, that admin consent has been granted, and that you are using app-only authentication correctly when acquiring tokens and calling Microsoft Graph APIs.

You can refer to Get access without a user - Microsoft Graph | Microsoft Learn.
Teddie Dang 1,970 Reputation points Independent Advisor

2026-10-27T00:55:17.3766667+00:00

Hi @yamauchi

Are there any updates on this issue? If you've compared the Postman and bot configurations and the issue still persists, I recommend opening a new issue in the Microsoft Graph GitHub repository, where developers and contributors may be able to provide further insights.

Reference: Participating in a discussion - GitHub Docs.