"Forbidden" response on trying to create subscriptions using https://graph.microsoft.com/v1.0/subscriptions/

Question

"Forbidden" response on trying to create subscriptions using https://graph.microsoft.com/v1.0/subscriptions/

Mahesh Kurucheti 76

Hi Team,

When attempting to create subscriptions in our cloud environment using the API endpoint https://graph.microsoft.com/v1.0/subscriptions/, we receive a "Forbidden" response. However, when we execute the same request through Bruno, it works successfully.

To troubleshoot, we captured the list of IP addresses from Bruno’s network activity and added them as inbound addresses for our environment. After this change, it started working. However, we are unsure which specific IP addresses need to be allowlisted, whether we need to add the entire IP range, or if there is another recommended approach.

Could you please guide us on the correct way to resolve this issue?

0 comments

1 answer

Your answer

Answer 1

Hi @Mahesh Kurucheti

The behavior described suggests the issue may be related to network configuration rather than the Microsoft Graph subscription API itself. Since allowing additional inbound IP addresses resolved the issue, you may want to review the documented Microsoft Graph Change Notifications IP address ranges for your cloud environment rather than relying on individual IP addresses observed from Bruno.

Receive change notifications through webhooks - Microsoft Graph notes that firewalls can be configured to allow inbound connections from Microsoft Graph change notification services. If any firewall, WAF, reverse proxy, or IP restriction is present in front of the URLs used for Microsoft Graph change notifications, the documented ranges may be more appropriate than maintaining a list of individual addresses captured during testing. Individual IPs observed from Bruno may not represent all Microsoft Graph service endpoints and could change over time.

You may also find the following discussion relevant, as it describes the same validation-related error: Microsoft Graph Subscription Validation Fails with 403 Forbidden Despite Reachable Notification End…

I hope this information is helpful.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.