Skip to content

Commit 6429532

Browse files
authored
Fix typos and improve article clarity
1 parent f3ac824 commit 6429532

File tree

1 file changed

+6
-6
lines changed

1 file changed

+6
-6
lines changed

support/entra/entra-id/users-groups-entra-apis/error-call-me-endpoint-microsoft-graph.md

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
---
22
title: NoPermissionsInAccessToken when calling me endpoint in Microsoft Graph
3-
description: Describes an issue in which the you receive `NoPermissionsInAccessToken` error when you call `/me` endpoint in Microsoft Graph.
3+
description: Describes an issue in which you receive `NoPermissionsInAccessToken` error when you call `/me` endpoint in Microsoft Graph.
44
ms.date: 04/03/2025
55
ms.service: entra-id
66
ms.custom: sap:Getting access denied errors (Authorization)
77
ms.reviewer: willfid, v-weizhu
88
---
99
# NoPermissionsInAccessToken when calling /me endpoint
1010

11-
This article discusses an issue in which the you receive a `NoPermissionsInAccessToken` error message when you call the `/me` endpoint in Microsoft Graph. This article also explains why you can't call the `/me` endpoint by using a token that's acquired through the client credentials grant flow.
11+
This article discusses an issue in which you receive a `NoPermissionsInAccessToken` error message when you call the `/me` endpoint in Microsoft Graph. This article also explains why you can't call the `/me` endpoint by using a token that is acquired through the client credentials grant flow.
1212

1313
## Symptoms
1414

@@ -32,9 +32,9 @@ When you try to call the `/me` endpoint from your Microsoft Entra ID-based appli
3232

3333
## Cause
3434

35-
The `/me` endpoint is designed to enable signed-in users to retrieve their own information. To call the `/me` endpoint, you must provide some user context because the endpont uses delegated permissions. This means that a token that's generated by using the client credentials grant flow can't use the `/me` endpoint because the user context information is absent.
35+
The `/me` endpoint is designed to enable signed-in users to retrieve their own information. To call the `/me` endpoint, you must provide some user context because the endpint uses delegated permissions. That is, a token that's generated by using the client credentials grant flow can't use the `/me` endpoint because the user context information is absent.
3636

37-
Tokens that are obtained by using the client credentials grant flow represent application identities, not user identities. These tokens contain a **roles** claim for application permissions instead of a scp (scopes) claim for delegated permissions. The absence of user context makes it impossible for the `/me` endpoint to determine the user who's associated with the request.
37+
Tokens that are obtained by using the client credentials grant flow represent application identities, not user identities. These tokens contain a **roles** claim for application permissions instead of a scp (scopes) claim for delegated permissions. The absence of user context makes it impossible for the `/me` endpoint to determine the user who is associated with the request.
3838

3939
### Example tokens
4040

@@ -46,13 +46,13 @@ This token is granted by using delegated flow to which a user signed in. It cont
4646

4747
**Token with application identity (client_credentials grant flow)**
4848

49-
This token is generated by using the client credentials grant flow. It doesn't contain user-specific information. Insead, it contains a `roles` claim for application permissions.
49+
This token is generated by using the client credentials grant flow. It doesn't contain user-specific information. Instead, it contains a `roles` claim for application permissions.
5050

5151
:::image type="content" source="media/error-call-me-endpoint-microsoft-graph/token-application-context.png" alt-text="Screenshot that shows an application token example." lightbox="media/error-call-me-endpoint-microsoft-graph/token-application-context.png":::
5252

5353
## Solution
5454

55-
When you use the client credentials grant flow in your application, you must use the `/users` endpoint instead of the `/me` endpoint. This enables you to retrieve user-specific information by using application tokens.
55+
When you use the client credentials grant flow in your application, you must use the `/users` endpoint instead of the `/me` endpoint. The `/users` endpoint enables you to retrieve user-specific information by using application tokens.
5656

5757
For example, if you want to call `GET https://graph.microsoft.com/v1.0/me/memberOf` to generate a list of groups that a user is a member of, use the following method:
5858

0 commit comments

Comments
 (0)