Observability

Microsoft 365 License Statistics API Poller Returns 401 Unauthorized in SAM Due to Unsupported OAuth Grant Type

When configuring the Microsoft 365 License Statistics API Poller template in SolarWinds SAM, you may receive a 401 Unauthorized response even after assigning the required Microsoft Graph Reports.Read.All application permission. Testing with Postman can successfully return 200 OK, which confirms that the Microsoft Graph endpoint and Azure app registration are functioning correctly. The issue occurs because the authentication method used in Postman differs from the OAuth flow currently supported by SAM API Poller, resulting in an authorization failure during polling. SolarWinds documentation for Microsoft 365 templates requires the Graph .default scope and application permissions.

First published date

4/8/2026 4:43 PM

Last published date

4/8/2026 4:43 PM

Overview

Scenario: monitoring Office 365 license activation statistics using the Microsoft 365 License Statistics API Poller template in Server & Application Monitor.

The configured Microsoft Entra application already has the required Reports.Read.All application permission, and manual API testing from Postman against the Microsoft Graph beta reports endpoint successfully return a 200 OK response.

However, when the same tenant ID, client ID, secret, token URL, and scope values are configured in the SAM API Poller credential, the component test fails with 401 Unauthorized.

The behavior is isolated to the OAuth client authentication method used during token acquisition. The Postman test uses a flow variation that succeeds interactively, while the SAM API Poller currently supports the OAuth 2.0 Client Credentials grant type for this Microsoft 365 template, which requires app-only access and the .default scope. Microsoft Graph app-only access specifically requires grant_type=client_credentials with https://graph.microsoft.com/.default.

Product section

Hybrid Cloud Observability

Cause

Resolution

To isolate whether the issue is related to SolarWinds or Microsoft Graph permissions, first validate the API call outside SAM using Postman.

Create a GET request to the following endpoint:

Download Postman.
You may install the Postman to the SolarWinds Platform server or any computer that can access the Azure portal.
Run Postman and go to the Collection tab:
Enter the API GET Request: https://graph.microsoft.com/beta/reports/getOffice365ActivationCounts?$format=application/json
Go to the Authorization tab and select OAuth 2.0. Specify the necessary parameters
Click Send and take a screenshot of the response returned

If the response returns 200 OK, this confirms:

Azure app registration is valid
Graph endpoint is reachable
Required permissions are present
Admin consent is already granted
- Microsoft 365 License Statistics API poller template
- API poller authentication and authorization
You can also check: SAM Microsoft Office 365 application monitor template requirements | Success Center | Salesforce

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.