Steps to troubleshoot Microsoft 365 Graph API responses via debug tools
From Applications Manager version 16310 onwards, Microsoft 365 monitor will use Microsoft Graph API as the primary mode of data collection.
We have migrated from PowerShell to Graph API as Microsoft 365 PowerShell commands were taking more time to execute for huge resources and needed Administrative user privileges to execute the commands. Microsoft provides only archived data in the Graph API. To monitor live data, use the PowerShell mode considering the user privileges and the time taken to fetch huge resources. For
REST API related common errors in the Applications Manager from version
16310, refer
this KB.
Prerequisites:
Ensure that you have met all the prerequisites for the Microsoft 365 monitor.
1. Get access token
- Go to Application Manager Settings -> Tools -> Self Help Tools -> URL Debug.
- Choose New Monitor in Monitor Name, HTTP(s) URLs in Monitor Type.
- Give the values as suggested below and replace TENANTID, CLIENT_ID & CLIENT_SECRET with respective values:
- URL Address: https://login.microsoftonline.com/TENANTID/oauth2/v2.0/token
- Expand HTTP Configurations.
- Form Submission Method: POST
- Payload Type: Text
- Request Parameters: grant_type=client_credentials&scope=https://graph.microsoft.com/.default&client_id=CLIENT_ID&client_secret=CLIENT_SECRET
- Ensure that the client secret value does not contain equal to (=) and comma (,) symbol.
- Custom HTTP(S) Headers:
- Header Name: Content-Type
- Header Value: application/x-www-form-urlencoded
- Click Execute button.
- If the Response code is 200, click the icon under Webpage content to view the response and copy the access_token value from the JSON response.
- If the response code is not 200, generate a PDF report by clicking icon and reach out to appmanager-support@manageengine.com along with the latest Support Information File (SIF) from Applications Manager with print all logs enabled for analysis.
After a successful response:
2. Get Graph API response
- After copying the access_token value, click Back to URL Debug.
- Enter the below details to get the Graph API response:
- URL Address: Enter the desired URL listed below.
- Expand HTTP Configurations.
- Form Submission Method: GET
- Custom HTTP(S) Headers:
- Header Name: Authorization
- Header Value: Bearer ACCESS_TOKEN (Replace the copied access_token value)
- For URLs with $count add the header: ConsistencyLevel: eventual
- Click Execute button.
- Check for the response.
- If the response code is not 200, generate PDF report by clicking icon and reach out to appmanager-support@manageengine.com along with the latest Support Information File (SIF) from Applications Manager with print all logs enabled for analysis.
After successful response:
How to check Graph API Response in POSTMAN?
1. Get access token
- To get the access token to hit the above APIs, enter the below details and send the request in POSTMAN.
- Request type: POST
- URL: https://login.microsoftonline.com/{{TenantID}}/oauth2/v2.0/token
- Authorization tab: Type: OAuth 2.0, Add authorization data to: Request Headers
- Body Tab: choose x-www-form-urlencoded
- click Bulk edit and paste the below content
- grant_type:client_credentials
- scope:https://graph.microsoft.com/.default
- client_id:{{ClientID}}
- client_secret:{{ClientSecret}}
- Click Send. In the response we should be able to get the access token as in the image below:
2. Get GRAPH API response
- Copy the access token got from the above steps.
- Make a new request with the below details:
- Request Type: GET
- URL: <URL>
- Authorization tab:
- Type: Bearer Token
- Token: <Paste the Access Token>
- For URLs with $count add the below header.
- ConsistencyLevel: eventual
- Click Send and check for the response. Find a sample response below.
How to troubleshoot using debug logs?
Debug logs are found in
<APM_HOME>/logs/stdout files. Check for the below prints and
refer this KB to troubleshoot the issue with the API error and response codes. If not found, gather error traces and reach out
to appmanager-support@manageengine.com along with the latest Support Information File (SIF) from Applications Manager with print all logs enabled for analysis.Microsoft 365
- Check for the debug prints starting with
- Office365::
- Office365MainDataCollector::
- Office365Util::
- Search for the below URL responses
- https://graph.microsoft.com/v1.0/admin/serviceAnnouncement/healthOverviews
- https://graph.microsoft.com/v1.0/reports/getOffice365ActivationCounts
- https://graph.microsoft.com/v1.0/users/$count
- https://graph.microsoft.com/v1.0/users/$count?$filter=assignedLicenses/$count eq 0
- https://graph.microsoft.com/v1.0/subscribedSkus?$select=capabilityStatus,consumedUnits,id,skuId,skuPartNumber,prepaidUnits
- https://graph.microsoft.com/v1.0/reports/getOffice365ServicesUserCounts(period='D7')
Exchange Online
- Check for the debug prints starting with
- ExchangeOnline::
- Office365Util::
- Search for the below URL responses
- https://graph.microsoft.com/v1.0/admin/serviceAnnouncement/healthOverviews
- https://graph.microsoft.com/v1.0/reports/getMailboxUsageDetail(period='D7')
SharePoint Online
- Check for the debug prints starting with
- SharepointOnline::
- Office365Util::
- Search for the below URL responses
- https://graph.microsoft.com/v1.0/admin/serviceAnnouncement/healthOverviews
- https://graph.microsoft.com/v1.0/reports/getSharePointSiteUsageDetail(period='D7')
Microsoft Teams
- Check for the debug prints starting with
- MicrosoftTeams::
- Office365Util::
- Search for the below URL responses
- https://graph.microsoft.com/v1.0/admin/serviceAnnouncement/healthOverviews
- https://graph.microsoft.com/v1.0/reports/getTeamsDeviceUsageDistributionUserCounts(period='D30')
- https://graph.microsoft.com/v1.0/reports/getTeamsDeviceUsageUserCounts(period='D7')
- https://graph.microsoft.com/v1.0/reports/getTeamsUserActivityUserCounts(period='D7')
- https://graph.microsoft.com/v1.0/reports/getTeamsUserActivityCounts(period='D7')
- https://graph.microsoft.com/beta/teams?$select=id,displayName&$count=true&$top=1
Sample URL Responses:
For positive cases (Able to fetch data):
- HashMap from URLDataCollector={responsecode=200, errMsg=, errorCode=0, htmlresponse={"@odata.context":"https://graph.microsoft.com/beta/$metadata#teams(id,displayName)","@odata.count":4,"@odata.nextLink":"https://graph.microsoft.com/beta/teams?$select=id%2cdisplayName&$count=true&$top=1&$skiptoken=m~AQAnOzgyNWEzMWNhN2U4ZTQ1NzY5NDgyODdjZTUyYmRiNzI3OzswOzA7","value":[{"id":"825a31ca-7e8e-4576-9482-87ce52bdb727","displayName":"APM"}]}} ===> KeyValue_Monitor-3#10000284#Thu Dec 15 10:48:37 IST 2022|
- Available : RESPONSE : [OrigURL=https://graph.microsoft.com/beta/teams?$select=id,displayName&$count=true&$top=1, EffectiveURL=https://graph.microsoft.com/beta/teams?$select=id,displayName&$count=true&$top=1, IP=20.190.145.169, RedirectCount=0, Status Code:200, Content Length:351]
For negative cases (Unable to fetch data):
- UnAvailable : Url=https://graph.microsoft.com/v1.0/reports/getOffice365ServicesUserCounts(period='D7'), QS=, ct=default, uroles=FREEUSER, CS=1, Proxy=false, UA=, t=30, Retry=false, RetryDelay=5, log=false, DNS = false()
UnAvailable : RESPONSE : [OrigURL=https://graph.microsoft.com/v1.0/reports/getOffice365ServicesUserCounts(period='D7'), EffectiveURL=https://graph.microsoft.com/v1.0/reports/getOffice365ServicesUserCounts(period='D7'), IP=20.190.145.171, RedirectCount=0, Status Code:403, Content Length:279] - CloudUtility :: getResponse() :: Else Block::URL[graph.microsoft.com/v1.0/reports/getOffice365ServicesUserCounts(period='D7')]::Error while fetching response::DataCollectorResponse::{responsecode=403, errMsg=, errorCode=0, htmlresponse={"error":{"code":"UnknownError","message":"{\"error\":{\"code\":\"S2SUnauthorized\",\"message\":\"Invalid permission.\"}}","innerError":{"date":"2022-12-28T09:55:31","request-id":"0dce21f2-d9ef-4bd7-9ff7-f67a008e58ac","client-request-id":"0dce21f2-d9ef-4bd7-9ff7-f67a008e58ac"}}}, error=403, authentication=failed} ===> KeyValue_Monitor-22#10000261#Wed Dec 28 15:25:20 IST 2022|
New to ADSelfService Plus?