Graph error 403 FORBIDDEN Mit dem Code: 7505("Request authorization tenant mismatch.")

Hallo Ignition-Bot

Darf ich wissen, ob Sie die Möglichkeit haben, meine Antwort zu überprüfen? Ich helfe dir gerne weiter, wenn du weitere Fragen hast

Hi, thanks for the reply.

If you take another look at the code in my post: we used application permissions for this. We decoded the JWT on jwt.ms; it shows our tid and all required app-only permissions (Calls.JoinGroupCall.All, Calls.AccessMedia.All, Calls.Initiate.All, Calls.InitiateGroupCall.All, OnlineMeetings.ReadWrite.All) correctly listed and granted via admin consent.

Maybe we are passing the wrong meeting ID in the payload?
We are using this:

Is our payload correct? (see above) Do I also need to configure additional settings in the Azure Bot Service resource (Bot Channels Registration) that could cause this error? We are wondering in general whether the Azure Bot resource is necessary:
is it an identity that we create for the bot?

We would greatly appreciate further information, in particular:

How do we obtain the correct meeting ID that we need?

How can we check whether Conditional Access policies or role-based requirements are blocking our request?

Thank you!
<<removed PII>>

Hello Ignition-Bot

Thank you so much for your reply and for sharing your input. Please allow me a little time to recheck and review these.

In the meantime, if you need more specialized support, I kindly recommend reaching out to Azure Support. They can offer deeper technical insights while we work on this together.

Your patience and understanding mean a lot, and I truly appreciate your collaboration as we work toward resolving this issue. Please feel free to share any updates or additional details in the meantime. Please note that our forum is a public platform, and we will modify your question to hide your personal information in the description. Kindly ensure that you hide any personal or organizational information the next time you post an error or other details to protect personal data.

Hello Ignition-Bot

Sorry for the late reply.

• Your current code builds the payload using a meetingId variable, but I don’t see any call to retrieve the correct JoinMeetingId from Microsoft Graph. Do you have a chance to take a look at this Microsoft Graph documentation to retrieve the meeting details and confirm the correct JoinMeetingId? Get onlineMeeting - Microsoft Graph v1.0 | Microsoft Learn You can integrate this API call into your code and log the response to verify that the joinMeetingId matches what you’re passing in the payload.
• Regarding your question about Azure Bot Service: Based on my research, the Bot Channels Registration resource is generally required for production scenarios. It acts as the bot’s identity and registration mechanism, creates an Azure AD App under the hood, and enables Teams channel integration and callback handling. Without it, you cannot fully comply with Microsoft’s guidelines for voice bots.
• Finally, to check if Conditional Access or RBAC policies are blocking your request, go to Microsoft Entra Admin Center, check Sign-in logs under the Conditional Access tab, filter by your bot’s Application ID, and review failures under Service principal sign-ins. Use the Conditional Access tab and the What If tool to simulate policies for your app and Graph resource.

Please try these steps and let me know what you find. If you can share an anonymized payload and the API response for joinMeetingId, I’ll help review. However, the most effective next step would be to create a support ticket in Microsoft Entra Admin for deeper investigation.

Hi,
thanks for the answer to my question!
This is our method with which we want to build the payload and join the meeting:

We pass the meeting ID as a parameter when we call the endpoint via Swagger UI. There we always provide the meeting ID that we find in Teams in our meeting chat under Meeting details. Here is a screenshot showing exactly which one:

Is that the correct meeting ID we need?
Thanks for your effort!