调用Microsoft Graph API报表接口遇404 UnknownTenantId错误求助

Let’s walk through the most likely causes and fixes for this issue, where you’re getting an unrecognized tenant ID error instead of the expected 302 redirect for your CSV report:

1. Confirm Your Tenant ID is 100% Correct #

The error message directly flags an unrecognized tenant ID, so start with the basics:

• Double-check the tenant ID against what’s listed in Azure Portal > Azure Active Directory > Overview—even a single misplaced character will trigger this error.
• If this is a demo tenant, verify it’s still active (not deleted, suspended, or expired if it was a trial).

2. Validate Your Authentication Token #

The Graph API uses the tenant ID embedded in your access token, not just the URL path. Here’s what to check:

• Decode your access token with a standard JWT decoder and confirm the tid claim matches your target tenant ID.
• If using client credentials flow, ensure you’re authenticating against the specific tenant endpoint (e.g., https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token) instead of the common endpoint—using common can lead to tokens issued for the wrong tenant if multiple accounts are involved.
• Make sure your app registration exists in the target tenant, not a different one.

3. Check API Permissions #

Missing or incorrect permissions can cause unexpected errors that mask the real issue:

• For the getOffice365ActiveUserCounts report, your app needs either the Reports.Read.All application permission or Reports.Read delegated permission.
• If using application permissions, confirm you’ve clicked "Grant admin consent" in the Azure Portal app registration section—without this, the permission isn’t actually applied.

4. Verify Tenant Eligibility for Reporting #

Not all tenant types have access to these reports:

• Demo/trial tenants may have limitations—ensure your tenant is licensed for an Office 365 plan that includes reporting features (e.g., Business Premium, Enterprise E3/E5).
• If it’s a trial tenant, check that the trial period hasn’t expired, which would restrict access to reporting APIs.

5. Double-Check Your Request Format #

Even small formatting mistakes can throw off the API:

• Confirm your request URL is properly formatted: https://graph.microsoft.com/v1.0/reports/getOffice365ActiveUserCounts(period='D7') (note the single quotes around the D7 value—double quotes will cause parsing errors).
• Ensure you’re sending a GET request with a valid Authorization header in the format: Bearer {your-access-token}.

Example of a Valid Request #

GET https://graph.microsoft.com/v1.0/reports/getOffice365ActiveUserCounts(period='D7')
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6...
Accept: application/json

If you’ve gone through all these steps and still see the error, reach out to Microsoft support with the request-id and date from the inner error—this will help their team trace the issue faster.

内容的提问来源于stack exchange，提问作者Maxime Pacary