Request authorization tenant mismatch

The “Request authorization tenant mismatch” error indicates that the access token you’re using isn’t valid for the tenant where the meeting actually exists even if the tenant IDs look correct in your code.

To troubleshoot, please verify the following:

• The app registration and the token request must use the same tenant ID where the meeting is scheduled.
• The token’s tid claim must match the meeting organizer’s tenant ID.
• The token’s aud claim must be https://graph.microsoft.com/.
• If you’re joining on behalf of a user, that user must belong to the same tenant as the meeting organizer.

Token Request Example (Client Credentials Grant):

POST https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token
Content-Type: application/x-www-form-urlencoded

client_id={app-id}
&scope=https://graph.microsoft.com/.default
&client_secret={client-secret}
&grant_type=client_credentials

Sample Join Meeting Graph API Call:

POST https://graph.microsoft.com/v1.0/me/onlineMeetings/{meetingId}/joinWebUrl
Authorization: Bearer {access_token}
Content-Type: application/json

{
  // No body required for joinWebUrl, but for other join APIs, include user context if needed
}

Common pitfalls:

• Using /me/onlineMeetings requires a delegated token from the user who is joining.
• For app-only permissions, use: /users/{userId}/onlineMeetings/{meetingId}
• The identity represented by the token must exist in the same tenant as the meeting organizer.

Best practice: Use delegated permissions and acquire the token for the actual user joining, ensuring they are a member of the same tenant where the meeting is hosted.

References:

1. Graph API: Create and join online meetings
2. Azure AD Token Reference