first round

concepts/includes/known-issues/authentication.md

@@ -0,0 +1,72 @@
+---
+author: ombongifaith
+ms.topic: include
+ms.date: 02/06/2026
+ms.localizationpriority: medium
+---
+
+### Publisher message of "unverified" occurs during PowerShell and CLI app consent
+
+<!-- {
+  "ms.author": "",
+  "ms.reviewer": ""
+} -->
+
+**Status**: Active
+
+The consent page shows that the command-line app that caters to PowerShell and CLI is from an unverified publisher.
+
+#### Workaround
+
+To remove the "unverified" message, you can do an app registration of your own, on which you can set yourself as the verified publisher. You will need to go through the publisher verification process, and use the app ID on the Microsoft Graph PowerShell SDK, as follows:
+
+```powershell
+Connect-MgGraph -AppId "{your-own-app-id}" -Scopes "scope"
+```
+
+### Pre-consent for CSP apps doesn't work in some customer tenants
+
+<!-- {
+  "ms.author": "",
+  "ms.reviewer": ""
+} -->
+
+**Status**: Active
+
+Under certain circumstances, pre-consent for cloud solution provider (CSP) apps may not work for some of your customer tenants.
+
+For apps using delegated permissions, when using the app for the first time with a new customer tenant, you might receive this error after sign-in: `AADSTS50000: There was an error issuing a token`.
+
+For apps using application permissions, your app can acquire a token, but unexpectedly gets an access denied message when calling Microsoft Graph.
+
+We are working to fix this issue, so that pre-consent will work for all your customer tenants.
+
+#### Workaround
+
+To unblock development and testing, you can use the following workaround.
+
+> [!NOTE]
+> This is not a permanent solution and is only intended to unblock development. This workaround will not be required once the issue is fixed. This workaround does not need to be undone after the fix is in place.
+
+1. Open an Azure AD v2 PowerShell session and connect to your customer tenant by entering your admin credentials into the sign-in window. You can download and install Azure AD PowerShell V2 from [here](https://www.powershellgallery.com/packages/AzureAD).
+
+    ```powershell
+    Connect-AzureAd -TenantId {customerTenantIdOrDomainName}
+    ```
+
+2. Create the Microsoft Graph service principal.
+
+    ```powershell
+    New-AzureADServicePrincipal -AppId 00000003-0000-0000-c000-000000000000
+    ```
+
+### Azure AD v2.0 endpoint is not supported for CSP apps
+
+<!-- {
+  "ms.author": "",
+  "ms.reviewer": ""
+} -->
+
+**Status**: Active
+
+Cloud solution provider (CSP) apps must acquire tokens from the Azure AD (v1) endpoints to successfully call Microsoft Graph in their partner-managed customers. Currently, acquiring a token through the newer Azure AD v2.0 endpoint is not supported.

concepts/includes/known-issues/calendar.md

@@ -0,0 +1,17 @@
+---
+author: ombongifaith
+ms.topic: include
+ms.date: 02/06/2026
+ms.localizationpriority: medium
+---
+
+### Error attaching large files to events
+
+<!-- {
+  "ms.author": "",
+  "ms.reviewer": ""
+} -->
+
+**Status**: Active
+
+An app with delegated permissions returns `HTTP 403 Forbidden` when attempting to attach large files to an Outlook message or event that is in a shared or delegated mailbox. With delegated permissions, [createUploadSession](/graph/api/attachment-createuploadsession) succeeds only if the message or event is in the signed-in user's mailbox.

concepts/includes/known-issues/change-notifications.md

@@ -0,0 +1,25 @@
+---
+author: ombongifaith
+ms.topic: include
+ms.date: 02/06/2026
+ms.localizationpriority: medium
+---
+
+### Upgrade events for Teams app installation change notifications in chat scope are not delivered
+
+<!-- {
+  "ms.author": "",
+  "ms.reviewer": ""
+} -->
+
+**Status**: Active
+
+When a subscription for a Teams app installation change notification is created, if the scope is specific to or includes chats, upgrade events/notifications will not be delivered to the subscriber.
+
+For example: If a customer subscribes to `/appCatalogs/teamsApps/{teams-app-id}/installations?$filter=(scopeInfo/scope eq 'groupChat')`, they will not receive notifications for upgrade/update events. However, they will receive other notifications regarding installations and deletions.
+
+Another example: If a customer subscribes to `/appCatalogs/teamsApps/{teams-app-id}/installations`, they will not receive notifications for upgrade/update events occurring specifically within chats. However, they will receive all other forms of notifications in teams and user's personal scope. But, in chats, they will only receive installation and deletion notifications.
+
+#### Workaround
+
+Currently no workaround for this issue is available.

concepts/includes/known-issues/customer-booking.md

@@ -0,0 +1,34 @@
+---
+author: ombongifaith
+ms.topic: include
+ms.date: 02/06/2026
+ms.localizationpriority: medium
+---
+
+### Error when querying bookingBusinesses
+
+<!-- {
+  "ms.author": "",
+  "ms.reviewer": ""
+} -->
+
+**Status**: Active
+
+Getting the list of **bookingBusinesses** fails with the following error code when an organization has several Bookings businesses and the account making the request is not an administrator:
+
+```json
+{
+  "error": {
+    "code": "ErrorExceededFindCountLimit",
+    "message": "The GetBookingMailboxes request returned too many results. Please specify a query to limit the results."
+  }
+}
+```
+
+#### Workaround
+
+You can limit the set of businesses returned by the request by including a query parameter, for example:
+
+```http
+GET https://graph.microsoft.com/beta/bookingBusinesses?query=Fabrikam
+```

concepts/includes/known-issues/delta-query.md

@@ -0,0 +1,17 @@
+---
+author: ombongifaith
+ms.topic: include
+ms.date: 02/06/2026
+ms.localizationpriority: medium
+---
+
+### OData context is returned incorrectly
+
+<!-- {
+  "ms.author": "",
+  "ms.reviewer": ""
+} -->
+
+**Status**: Active
+
+OData context is sometimes returned incorrectly when tracking changes to relationships.

concepts/includes/known-issues/device-app-management.md

@@ -0,0 +1,20 @@
+---
+author: ombongifaith
+ms.topic: include
+ms.date: 02/06/2026
+ms.localizationpriority: medium
+---
+
+### Accessing and updating deployment audiences is not supported
+
+<!-- {
+  "ms.author": "",
+  "ms.reviewer": ""
+} -->
+
+**Status**: Active
+
+Accessing and updating deployment audiences on deployment resources created via Intune is not currently supported.
+
+- Listing deployment audience members and listing deployment audience exclusions returns `404 Not Found`.
+- Updating deployment audience members and exclusions or updating by ID returns `202 Accepted` but the audience is not updated.

concepts/includes/known-issues/groups.md

@@ -0,0 +1,41 @@
+---
+author: ombongifaith
+ms.topic: include
+ms.date: 02/06/2026
+ms.localizationpriority: medium
+---
+
+### Non-admin user can't add self as group owner during group creation or update
+
+<!-- {
+  "ms.author": "",
+  "ms.reviewer": ""
+} -->
+
+**Status**: Active
+
+When a non-admin user calls the [Create group](/graph/api/group-post-groups) API, [Update group](/graph/api/group-update) API, or [Upsert group](/graph/api/group-upsert) API and adds their user ID in the request body in the **owners@odata.bind** collection, the request fails with a `400 Bad Request` error code with the message "Request contains a property with duplicate values." A non-admin user can't explicitly add themselves as the group owner.
+
+#### Workaround
+
+There is no workaround for this error.
+
+By default, a non-admin user who is creating a security or Microsoft 365 group through the [Create group](/graph/api/group-post-groups) API or [Upsert group](/graph/api/group-upsert) API is automatically added to the **owners** collection of the group, if they don't specify any group owners. If they specify others as group owners, the non-admin group creator is still automatically added to the **owners** collection of the security group, but not for the Microsoft 365 group. The user still can't add themselves to the **owners** collection during group update.
+
+### GET /groups/{id}/members doesn't return service principals in v1.0
+
+<!-- {
+  "ms.author": "",
+  "ms.reviewer": ""
+} -->
+
+**Status**: Active
+
+The [List group members](/graph/api/group-list-members) API operation on the v1.0 endpoint currently doesn't return any service principals that might be members of the queried group.
+
+#### Workaround
+
+As a workaround, use one of the following options:
+
+- Use the [List group members](/graph/api/group-list-members?view=graph-rest-beta) API operation on the beta endpoint.
+- Use the `/groups/{id}?$expand=members` API operation.

concepts/includes/known-issues/identity-access.md

@@ -0,0 +1,64 @@
+---
+author: ombongifaith
+ms.topic: include
+ms.date: 02/06/2026
+ms.localizationpriority: medium
+---
+
+### Use of specific query parameters on /subscribedSkus and /domains doesn't return the expected results
+
+<!-- {
+  "ms.author": "",
+  "ms.reviewer": ""
+} -->
+
+**Status**: Active
+
+The following usage of query parameters that target **subscribedSkus** and **domain** entities might not return the expected results:
+
+- Use of `$search` on both **subscribedSkus** or **domain** entities
+- Use of `$top` and `$filter` on the **domain** entity
+
+Currently, these parameters are effectively ignored, and the queries don't return the expected results.
+
+#### Workaround
+
+To prevent any disruption to your business processes, we recommend that you modify your application code to remove usage of these query parameters from queries that target the **subscribedSkus** or **domain** entities and run the search, top, and filter on the client side.
+
+### Configuring federated domains in delegated scenarios requires Directory.AccessAsUser.All permission
+
+<!-- {
+  "ms.author": "",
+  "ms.reviewer": ""
+} -->
+
+**Status**: Active
+
+The [Create internalDomainFederation](/graph/api/domain-post-federationconfiguration), [Update internalDomainFederation](/graph/api/internaldomainfederation-update), and [Delete internalDomainFederation](/graph/api/internaldomainfederation-delete) might require you to grant consent to the *Directory.AccessAsUser.All* permission. This requirement is a temporary workaround till we provide a more granular delegated permission for managing federated domains.
+
+### Claims mapping policy might require consent to additional permissions
+
+<!-- {
+  "ms.author": "",
+  "ms.reviewer": ""
+} -->
+
+**Status**: Active
+
+The [claimsMappingPolicy](/graph/api/resources/claimsmappingpolicy) API might require consent to both the *Policy.Read.All* and *Policy.ReadWrite.ConditionalAccess* permissions for the `LIST /policies/claimsMappingPolicies` and `GET /policies/claimsMappingPolicies/{id}` methods, as follows:
+
+- If no **claimsMappingPolicy** objects are available to retrieve in a LIST operation, either permission is sufficient to call this method.
+- If there are **claimsMappingPolicy** objects to retrieve, your app must consent to both permissions. If not, a `403 Forbidden` error is returned.
+
+In the future, either permission will be sufficient to call both methods.
+
+### Conditional access policy requires consent to additional permission
+
+<!-- {
+  "ms.author": "",
+  "ms.reviewer": ""
+} -->
+
+**Status**: Active
+
+The [conditionalAccessPolicy](/graph/api/resources/conditionalaccesspolicy) API currently requires consent to the *Policy.Read.All* permission to call the POST and PATCH methods. In the future, the *Policy.ReadWrite.ConditionalAccess* permission will enable you to read policies from the directory.

concepts/includes/known-issues/json-batching.md

@@ -0,0 +1,23 @@
+---
+author: ombongifaith
+ms.topic: include
+ms.date: 02/06/2026
+ms.localizationpriority: medium
+---
+
+### Request dependencies are limited
+
+<!-- {
+  "ms.author": "",
+  "ms.reviewer": ""
+} -->
+
+**Status**: Active
+
+Individual requests can depend on other individual requests. Currently, requests can only depend on a single other request, and must follow one of these three patterns:
+
+- **Parallel** - no individual request states a dependency in the **dependsOn** property.
+- **Serial** - all individual requests depend on the previous individual request.
+- **Same** - all individual requests that state a dependency in the **dependsOn** property, state the same dependency. Note: Requests made using this pattern will run sequentially.
+
+As JSON batching matures, these limitations will be removed.

concepts/includes/known-issues/known-issues-in-microsoft-graph.md

@@ -0,0 +1,71 @@
+---
+title: "Known issues in Microsoft Graph"
+description: "Learn about known issues and limitations in Microsoft Graph APIs."
+author: ombongifaith
+ms.author: ombongifaith
+ms.topic: concept-article
+ms.localizationpriority: high
+ms.date: 02/06/2026
+---
+
+# Known issues in Microsoft Graph
+
+## Authentication
+
+[!INCLUDE [authentication](includes/known-issues/authentication.md)]
+
+## Calendar
+
+[!INCLUDE [calendar](includes/known-issues/calendar.md)]
+
+## Change notifications
+
+[!INCLUDE [change-notifications](includes/known-issues/change-notifications.md)]
+
+## Customer booking
+
+[!INCLUDE [customer-booking](includes/known-issues/customer-booking.md)]
+
+## Delta query
+
+[!INCLUDE [delta-query](includes/known-issues/delta-query.md)]
+
+## Device and app management
+
+[!INCLUDE [device-app-management](includes/known-issues/device-app-management.md)]
+
+## Groups
+
+[!INCLUDE [groups](includes/known-issues/groups.md)]
+
+## Identity and access
+
+[!INCLUDE [identity-access](includes/known-issues/identity-access.md)]
+
+## JSON batching
+
+[!INCLUDE [json-batching](includes/known-issues/json-batching.md)]
+
+## Mail
+
+[!INCLUDE [mail](includes/known-issues/mail.md)]
+
+## Query parameters
+
+[!INCLUDE [query-parameters](includes/known-issues/query-parameters.md)]
+
+## Search
+
+[!INCLUDE [search](includes/known-issues/search.md)]
+
+## Sites and lists
+
+[!INCLUDE [sites-lists](includes/known-issues/sites-lists.md)]
+
+## Teamwork and communications
+
+[!INCLUDE [teamwork-communications](includes/known-issues/teamwork-communications.md)]
+
+## Users
+
+[!INCLUDE [users](includes/known-issues/users.md)]