The security/threatSubmission/emailThreats returns 401 even to Global Administrator

Question

The security/threatSubmission/emailThreats returns 401 even to Global Administrator

Denys Soroka 71

There are no details - the title says all.

It is a note for the fellow developers - this API does not work.

I have spent two weeks with MS365 and the Azure support team. They refused to do anything, saying it’s acceptable for the API not to work because it’s in beta. I have no other option but to lament here.

0 comments

1 answer

Your answer

Answer 1

The security/threatSubmission/emailThreats endpoint is functional, but it has strict requirements that commonly cause 401 responses if not met.

Key points required for successful calls:

Correct endpoint and method

List submissions:

  GET /security/threatSubmission/emailThreats

Review a submission:

  POST /security/threatSubmission/emailThreats/{emailThreatsId}/review

Required permissions

For listing email threat submissions (GET /security/threatSubmission/emailThreats):
- Delegated (work or school):
  - Least privileged: ThreatSubmission.Read
  - Higher: ThreatSubmission.ReadWrite, ThreatSubmission.Read.All, ThreatSubmission.ReadWrite.All
- Application:
  - Least privileged: ThreatSubmission.Read.All
  - Higher: ThreatSubmission.ReadWrite.All
For reviewing a submission (POST .../review):
- Delegated (work or school): ThreatSubmission.ReadWrite.All
- Application: ThreatSubmission.ReadWrite.All
Personal Microsoft accounts are not supported.

If the access token does not include one of these exact Graph permissions, the API returns 401.

Token and header requirements

The request must include:
```
  Authorization: Bearer {token}
```
The token must be issued for Microsoft Graph and contain the required ThreatSubmission.* permission scopes/roles.
Using a Global Administrator account alone is not sufficient; the app or user must be granted and consented the specific ThreatSubmission permissions.

Beta API constraints

This API is under /beta and is explicitly documented as not supported for production use. However, it is expected to work when called with the correct permissions and tokens.

If 401 is returned even for a Global Administrator, typical causes are:

Missing or incorrect ThreatSubmission.* permissions on the app registration.
Admin consent not granted for those permissions.
Using a personal Microsoft account, which is not supported.
Using a token for the wrong resource (not Microsoft Graph) or without the required scopes/roles.

References: