Request authorization tenant mismatch

Question

Request authorization tenant mismatch

Baig, Farhan Ahmed 45

Code -

  const callPayload = {

    callbackUri: `${process.env.PUBLIC_URL}/media/callback`,

    requestedModalities: ["audio"],

    mediaConfig: {

      "@odata.type": "#microsoft.graph.serviceHostedMediaConfig",

      "preFetchMedia": [],

      "audio": {

        "unmixedAudio": true

      }

    },

    meetingInfo: {

      "@odata.type": "#microsoft.graph.joinMeetingIdMeetingInfo",

      meetingId: meetingId,

      tenantId: tenantId

    }

  };

await graphClient.api("/communications/calls").post(callPayload);

Access token URL- "https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/token"

The tenant of meeting and the tenant of bot are same. Still, I am getting the error -

Request authorization tenant mismatch

VEMULA SRISAI 3,590 Reputation points Microsoft External Staff Moderator

2025-12-11T11:28:10.5433333+00:00
The “Request authorization tenant mismatch” error indicates that the access token you’re using isn’t valid for the tenant where the meeting actually exists even if the tenant IDs look correct in your code.

To troubleshoot, please verify the following:

The app registration and the token request must use the same tenant ID where the meeting is scheduled.

The token’s tid claim must match the meeting organizer’s tenant ID.

The token’s aud claim must be https://graph.microsoft.com/.

If you’re joining on behalf of a user, that user must belong to the same tenant as the meeting organizer.

Token Request Example (Client Credentials Grant):

POST https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token Content-Type: application/x-www-form-urlencoded client_id={app-id} &scope=https://graph.microsoft.com/.default &client_secret={client-secret} &grant_type=client_credentials

Sample Join Meeting Graph API Call:

POST https://graph.microsoft.com/v1.0/me/onlineMeetings/{meetingId}/joinWebUrl Authorization: Bearer {access_token} Content-Type: application/json { // No body required for joinWebUrl, but for other join APIs, include user context if needed }

Common pitfalls:

Using /me/onlineMeetings requires a delegated token from the user who is joining.

For app-only permissions, use: /users/{userId}/onlineMeetings/{meetingId}

The identity represented by the token must exist in the same tenant as the meeting organizer.

Best practice: Use delegated permissions and acquire the token for the actual user joining, ensuring they are a member of the same tenant where the meeting is hosted.

References:

Graph API: Create and join online meetings

Azure AD Token Reference

1 answer

Your answer

VEMULA SRISAI 3,590 Reputation points Microsoft External Staff Moderator

2025-12-11T11:28:10.5433333+00:00

The “Request authorization tenant mismatch” error indicates that the access token you’re using isn’t valid for the tenant where the meeting actually exists even if the tenant IDs look correct in your code.

To troubleshoot, please verify the following:

The app registration and the token request must use the same tenant ID where the meeting is scheduled.

The token’s tid claim must match the meeting organizer’s tenant ID.

The token’s aud claim must be https://graph.microsoft.com/.

If you’re joining on behalf of a user, that user must belong to the same tenant as the meeting organizer.

Token Request Example (Client Credentials Grant):

POST https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token Content-Type: application/x-www-form-urlencoded client_id={app-id} &scope=https://graph.microsoft.com/.default &client_secret={client-secret} &grant_type=client_credentials

Sample Join Meeting Graph API Call:

POST https://graph.microsoft.com/v1.0/me/onlineMeetings/{meetingId}/joinWebUrl Authorization: Bearer {access_token} Content-Type: application/json { // No body required for joinWebUrl, but for other join APIs, include user context if needed }

Common pitfalls:

Using /me/onlineMeetings requires a delegated token from the user who is joining.

For app-only permissions, use: /users/{userId}/onlineMeetings/{meetingId}

The identity represented by the token must exist in the same tenant as the meeting organizer.

Best practice: Use delegated permissions and acquire the token for the actual user joining, ensuring they are a member of the same tenant where the meeting is hosted.

References:

Graph API: Create and join online meetings

Azure AD Token Reference

Answer 1

Hi Baig, Farhan Ahmed,

Thank you for sharing the resolution! Glad to hear the issue is now resolved. Updating the payload based on the “Example 5: Join scheduled meetings with service‑hosted media” section from the Graph API documentation was a great approach. This will definitely help others facing the same authorization/tenant mismatch error.
(https://dori-uw-1.kuma-moon.com/en-us/graph/api/application-post-calls?view=graph-rest-1.0&tabs=javascript#request-4)
Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.

Thankyou!

Share via

Request authorization tenant mismatch

1 answer

Your answer