microsoft/semantic-kernel · error · InvalidOperationException

Missing Scopes configuration for Microsoft Graph API.

Error message

Missing Scopes configuration for Microsoft Graph API.

What it means

Error "Missing Scopes configuration for Microsoft Graph API." thrown in microsoft/semantic-kernel.

Source

Thrown at dotnet/samples/Concepts/Plugins/ApiManifestBasedPlugins.cs:110

        Console.WriteLine($"\nResult:\n{result}\n");
        Console.WriteLine("--------------------");
    }

    private void WriteSampleHeadingToConsole(string pluginToTest, string functionToTest, KernelArguments? arguments, params string[] pluginsToLoad)
    {
        Console.WriteLine();
        Console.WriteLine("======== [ApiManifest Plugins Sample] ========");
        Console.WriteLine($"======== Loading Plugins: {string.Join(" ", pluginsToLoad)} ========");
        Console.WriteLine($"======== Calling Plugin Function: {pluginToTest}.{functionToTest} with parameters {arguments?.Select(x => x.Key + " = " + x.Value).Aggregate((x, y) => x + ", " + y)} ========");
        Console.WriteLine();
    }

    private async Task AddApiManifestPluginsAsync(Kernel kernel, params string[] pluginNames)
    {
#pragma warning disable SKEXP0050
        if (TestConfiguration.MSGraph.Scopes is null)
        {
            throw new InvalidOperationException("Missing Scopes configuration for Microsoft Graph API.");
        }

        LocalUserMSALCredentialManager credentialManager = await LocalUserMSALCredentialManager.CreateAsync().ConfigureAwait(false);

        var token = await credentialManager.GetTokenAsync(
                        TestConfiguration.MSGraph.ClientId,
                        TestConfiguration.MSGraph.TenantId,
                        TestConfiguration.MSGraph.Scopes.ToArray(),
                        TestConfiguration.MSGraph.RedirectUri).ConfigureAwait(false);
#pragma warning restore SKEXP0050

        BearerAuthenticationProviderWithCancellationToken authenticationProvider = new(() => Task.FromResult(token));
#pragma warning disable SKEXP0040

        // Microsoft Graph API execution parameters
        var graphOpenApiFunctionExecutionParameters = new OpenApiFunctionExecutionParameters(
            authCallback: authenticationProvider.AuthenticateRequestAsync,
            serverUrlOverride: new Uri("https://graph.microsoft.com/v1.0"),

View on GitHub (pinned to c028a0c7dc)

Solutions

1. Add a 'Scopes' entry to the Microsoft Graph API configuration section of the API manifest (e.g. 'User.Read') so the plugin can request the required permissions.
2. Verify the ApiManifest file referenced by the plugin includes the scopes array for the Microsoft Graph resource.

When it happens

Trigger: Thrown at dotnet/samples/Concepts/Plugins/ApiManifestBasedPlugins.cs:110 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of microsoft/semantic-kernel@c028a0c7dc (2026-08-13). Data as JSON: /api/errors/73148af6a3655936. Report an issue: GitHub.