MS365 Connector 4.0 update. Listener Error: Authorization Error. Your application may not have the correct permissions for the Microsoft Graph API

With app version 4.0 the possibility to synchronize Microsoft Teams via the Microsoft 365 Connector was added. To use this feature, additional privileges for the Microsoft Graph API need to be added to the configured App registrations in Azure, if the initial setup was run before the update.
If this is the case, you’ll also see this error in the listener.log after each service univention-directory-listener restart.

Authorization Error. Your application may not have the correct permissions for the Microsoft Graph API"

To add these additional permissions, you need to login to the Azure portal.
Select the Azure Active Directory service. In case you have multiple Active Directories, click Switch directory to choose the one you want to add your permissions to.
azure
Open the App registrations module.
Open the application which is connected to the Microsoft365 connector app on UCS and click on API permissions.
Click Add a permission, select the API Microsoft Graph, choose “Application Permissions” and search for and add the following permissions:

  • Directory ReadWrite.All
  • Group ReadWrite.All
  • TeamMember ReadWrite.All
  • User ReadWrite.All

Click on Grant admin consent for Univention Test GmbH to activate the newly added permissions.
newperm

By executing service univention-directory-listener restart the permission check will be repeated.
If the warning mentioned above does not appear, the permissions are now correct.