Teams meeting transcript content API returns 401 requiring "Office 365 Yammer" CA policy

Ian Gau 0 信譽點數
2026-11-03T09:27:19.79+00:00

Issue Description

Starting around October 20, 2026, calling the Microsoft Graph API to download a Teams meeting transcript content (GET /v1.0/me/onlineMeetings/{meetingId}/transcripts/{transcriptId}/content) consistently fails with **HTTP 401 Unauthorized

(ConditionalAccessEvaluationFailure)**, returning a claims challenge (capolids) that points to our tenant's "Block Office 365 Yammer (Viva Engage)" Conditional Access policy.

However, using the exact same access token:

  1. Listing the transcripts (GET /v1.0/me/onlineMeetings/{meetingId}/transcripts) succeeds with HTTP 200 OK.
  2. Getting the transcript metadata object (GET /v1.0/me/onlineMeetings/{meetingId}/transcripts/{transcriptId}) succeeds with HTTP 200 OK.
  3. Only the /content endpoint (Accept: text/vtt or Accept: application/vnd.microsoft.graph.transcript+text) fails with HTTP 401 and demands the capolids claim for the Office 365 Yammer Conditional Access policy.

Key Observations

  • No Yammer permissions or resources are used:
    • Token aud: https://graph.microsoft.com
    • Token scp: OnlineMeetingTranscript.Read.All OnlineMeetings.Read (No Yammer / Viva Engage scopes are requested or configured on the app registration).
    • The issue occurs identically with both delegated user tokens (MSAL interactive/silent) and ROPC tokens.
  • Conditional Access Policy triggered:
    • When we pass the returned claims challenge ({"access_token":{"capolids":{"essential":true,"values":[``[Moderator note: Personally Identifiable Information removed]``]}}}) back to the Entra ID /oauth2/v2.0/token endpoint, Entra ID returns AADSTS53003.
    • Checking the Entra ID non-interactive sign-in logs for that Correlation ID shows:
      • Application: Microsoft Graph
      • Policy Name: Block Yammer (Policy ID: [Moderator note: Personally Identifiable Information removed])
        • Target Resource configured in that CA policy: Office 365 Yammer (Viva Engage)
        • Grant Control: Block access (for All users, as Yammer/Viva Engage is disabled by organization policy).

Diagnostic Information (for Microsoft Backend Investigation)

1. Microsoft Graph /content HTTP 401 Response

  • Endpoint: GET https://graph.microsoft.com/v1.0/me/onlineMeetings/{meetingId}/transcripts/{transcriptId}/content
  • Headers: Accept: text/vtt (same result with Accept: application/vnd.microsoft.graph.transcript+text and on /beta)
  • HTTP Status: 401 Unauthorized
  • request-id: [Moderator note: Personally Identifiable Information removed]
  • client-request-id: [Moderator note: Personally Identifiable Information removed]
    • Date: Tue, 03 Nov 2026 08:44:52 GMT
    • x-ms-ags-diagnostic: {"ServerInfo":{"DataCenter":"Korea Central","Slice":"E","Ring":"4","ScaleUnit":"001","RoleInstance":"SE1PEPF000110BA"}}
    • Response Body:
    
  {

    "error": {

      "code": "Unauthorized",

      "message": "Additional claims required {\"access_token\":{\"capolids\":{\"essential\":true,\"values\":[\"

      "innerError": {

        "code": "ConditionalAccessEvaulationFailure",

        "message": "{\"access_token\":{\"capolids\":{\"essential\":true,\"values\":[\"

        "date": "2026-11-03T08:44:53",

        "request-

        "client-request-id": "

      }

    }

  }

  2. Entra ID Token Endpoint AADSTS53003 (When presenting the claims challenge)

  - Timestamp (UTC): 2026-11-03 06:44:34Z

  - Correlation ID: 

  - Trace ID: b4daaf9b-ff0e-49c5-b7d2-bfd8f93d1900

  ---

  Questions

  1. Why is the Microsoft Graph Teams transcript /content endpoint evaluating a Conditional Access policy targeted exclusively at Office 365 Yammer (

  2. Was there a recent backend change (around Oct 20, 2026) in how Microsoft Graph / Stream / Teams media services map downstream resource service principals when fetching transcript content?

  3. How can a tenant that blocks Office 365 Yammer via Conditional Access continue using the official Teams transcript content API (OnlineMeetingTranscript.Read.All) without unblocking Yammer?
Microsoft Teams | Microsoft Teams 商務版 | 會議和通話 | 其他
0 則留言

1 個回答

排序依據： 最實用
最實用 最新 最舊
  1. Jayden-P 4,225 信譽點數 獨立顧問
    2026-11-03T09:45:24.6866667+00:00

    I will answer you in English based on your previous message. As a friendly suggestion, posting in Chinese may help your question reach a wider audience and increase the chances of receiving assistance from other community members.

    Hi @Ian Gau

    Please note that this forum is not Microsoft support, this is a user-to-user support forum.

    Based on the error details, the request is not being rejected because of missing Graph permissions. The response shows:

    {
  "error": {
    "code": "Unauthorized",
    "message": "Additional claims required ..."
  }

    and specifically returns a Conditional Access claims challenge for policy ID, which you've already correlated to your tenant's Block Office 365 Yammer (Viva Engage) Conditional Access policy.

    What makes this particularly interesting is that the problem appears limited to the transcript content endpoint. Since transcript listing and metadata retrieval are working correctly with the same token and permissions, the Conditional Access challenge seems to be triggered only when the transcript content itself is requested. Based on the information provided, that doesn't immediately point to a standard permissions or consent issue.

    Based on the publicly available documentation, I'm not aware of any documented requirement for the Teams transcript content API to depend on Office 365 Yammer (Viva Engage). At this point, I think we're reaching the limits of what can be verified through public documentation. While the symptoms clearly point to the Yammer/Viva Engage Conditional Access policy being involved in the authorization flow, Microsoft doesn't publish the internal architecture for the transcript content service. As a result, forum users can only speculate as to whether this is by design, the result of a service-side change, or an unintended behavior that requires engineering review.

    Regarding your questions:

    1. I am not aware of any public documentation stating that the transcript /content endpoint should evaluate a Conditional Access policy scoped only to Office 365 Yammer.
    2. I have not seen any publicly announced change around October 2026 that would explain this behavior. Community members do not have visibility into service-side changes unless Microsoft publishes them.
    3. Based on the information provided, there is no documented method I can point to that would allow a tenant to continue blocking Yammer while bypassing this specific Conditional Access evaluation for the transcript content endpoint. If excluding the policy causes the request to succeed, that would strongly suggest the policy is involved in the authorization path, but determining whether that behavior is expected would require Microsoft investigation.

    Since this involves a tenant-specific Conditional Access policy and the behavior is occurring during authorization, I'd recommend contacting Microsoft Support and providing the request ID, correlation ID, trace ID, timestamp, and Conditional Access policy ID you've collected. These diagnostics should help the support team investigate whether the transcript content endpoint is incorrectly evaluating the Office 365 Yammer (Viva Engage) policy or whether there is a backend service dependency involved that is not documented publicly.

    此回答有幫助嗎？

    0 則留言

您的回答

答案可由問題作者標示為「已接受」，而由仲裁者標示為「推薦」，這可協助使用者知道答案解決了作者的問題。