In app-only access scenarios, Shifts Management Graph APIs previously required the MS-APP-ACTS-AS: userId header to indicate the user on whose behalf the application was acting. However, this conflicted with the Microsoft Graph permission model where there is no signed-in user for app-only access scenarios. To align Shifts Graph APIs with this model, the MS-APP-ACTS-AS header has now been deprecated.
What Action You Need to Take
If you don’t send the header today
There is no impact. No changes are necessary.
If you send the header today
1. Please remove the header.
Example:
Old:
GET /teams/{teamId}/schedule/shifts
MS-APP-ACTS-AS: d56f3e8a-2b0f-42b1-88b9-e2dbd12a34d2
New:
GET /teams/{teamId}/schedule/shifts
2. For offerShiftRequest, openShiftsChangeRequest, swapShiftsChangeRequest, timeOffRequest, or timeCard, you may need to switch to a new API or add an additional property in the request body. Please see the instructions below.
ScheduleChangeRequest (offerShiftRequest, openShiftsChangeRequest, swapShiftsChangeRequest, timeOffRequest)
Approve a ScheduleChangeRequest
- If you are using /approve API with application permissions, please use /approveForUser instead.
- Eventually, /approve will only support delegated permissions
Example
Old:
POST /teams/{teamId}/schedule/timeOffRequests/{requestId}/approve
MS-APP-ACTS-AS: d56f3e8a-2b0f-42b1-88b9-e2dbd12a34d2
Content-type: application/json
{
"message": "approved"
}
New:
POST /teams/{teamId}/schedule/timeOffRequests/{requestId}/approveForUser
Content-Type: application/json
{
"message": "approved",
“userId”: "d56f3e8a-2b0f-42b1-88b9-e2dbd12a34d2"
}
Decline a ScheduleChangeRequest
- If you are using /decline API with application permissions, please use /declineForUser instead.
- Eventually, /decline will only support delegated permissions
Example
Old:
POST /teams/{teamId}/schedule/timeOffRequests/{requestId}/decline
MS-APP-ACTS-AS: d56f3e8a-2b0f-42b1-88b9-e2dbd12a34d2
Content-type: application/json
{
"message": "declined"
}
New:
POST /teams/{teamId}/schedule/timeOffRequests/{requestId}/declineForUser
Content-Type: application/json
{
"message": "declined",
“userId”: "d56f3e8a-2b0f-42b1-88b9-e2dbd12a34d2"
}
Create a TimeOffRequest
- POST teams/{teamId}/schedule/timeOffRequests
- Previously, senderUserId was an optional property as the value provided by MS-APP-ACTS-AS was used as the sender user ID. Since MS-APP-ACTS-AS is deprecated, please provide the sender user ID through senderUserId property.
- Example
Old:
POST teams/{teamId}/schedule/timeOffRequests
MS-APP-ACTS-AS: d56f3e8a-2b0f-42b1-88b9-e2dbd12a34d2
Content-type: application/json
{
"timeOffReasonId": "TOR_08c42f26-9b83-492c-bf52-f3609eb083e3",
"startDateTime": "2025-05-26T07:00:00Z",
"endDateTime": "2025-05-27T07:00:00Z"
}
New:
POST teams/{teamId}/schedule/timeOffRequests
Content-type: application/json
{
"timeOffReasonId": "TOR_08c42f26-9b83-492c-bf52-f3609eb083e3",
"startDateTime": "2025-05-26T07:00:00Z",
"endDateTime": "2025-05-27T07:00:00Z",
"senderUserId": "3f2504e0-4f89-11d3-9a0c-0305e82c3301"
}
Create an OpenShiftsChangeRequest
- POST /teams/{teamId}/schedule/openShiftChangeRequests
- Previously, senderUserId was an optional property as the value provided by MS-APP-ACTS-AS was used as the sender user ID. Since MS-APP-ACTS-AS is deprecated, please provide the sender user ID through senderUserId property.
Example
Old
POST teams/{teamId}/schedule/openShiftChangeRequests
MS-APP-ACTS-AS: d56f3e8a-2b0f-42b1-88b9-e2dbd12a34d2
Content-type: application/json
{
"senderMessage": "Can I take this shift?",
"openShiftId": "577b75d2-a927-48c0-a5d1-dc984894e7b8"
}
New
POST teams/{teamId}/schedule/openShiftChangeRequests
Content-type: application/json
{
"senderMessage": "Can I take this shift?",
"openShiftId": "577b75d2-a927-48c0-a5d1-dc984894e7b8",
"senderUserId": "d56f3e8a-2b0f-42b1-88b9-e2dbd12a34d2"
}
TimeCard
Confirm a TimeCard
- Please use /confirmForUser instead of /confirm.
| Old API | New API |
|---|---|
| teams/{teamId}/schedule/timeCards/{timeCardId}/confirm | teams/{teamId}/schedule/timeCards/{timeCardId}/confirmForUser |
Example:
Old
POST teams/{teamId}/schedule/timeCards/{timeCardId}/confirm
MS-APP-ACTS-AS: d56f3e8a-2b0f-42b1-88b9-e2dbd12a34d2
New
POST teams/{teamId}/schedule/timeCards/{timeCardId}/confirmForUser
Content-Type: application/json
{
“userId”: "d56f3e8a-2b0f-42b1-88b9-e2dbd12a34d2"
}
Clock in a TimeCard
- POST teams/{teamId}/schedule/timeCards/clockIn
- Previously, onBehalfOfUserId was an optional property as the value provided by MS-APP-ACTS-AS was used as the ID of the user that is clocking in. Since MS-APP-ACTS-AS is deprecated, please provide the ID of the user that is clocking in through onBehalfOfUserId property.
- Example:
Old
POST teams/{teamId}/schedule/timeCards/clockIn
MS-APP-ACTS-AS: d56f3e8a-2b0f-42b1-88b9-e2dbd12a34d2
New
POST teams/{teamId}/schedule/timeCards/clockIn
Content-type: application/json
{
"onBehalfOfUserId": "3f29c8e7-7a41-4d8e-99d6-2b1f76c9421e"
}
Create a TimeCard
- POST /teams/{teamId}/schedule/timeCards
- Previously, userId was an optional property as the value provided by MS-APP-ACTS-AS was used as the ID of the owner of the timeCard. Since MS-APP-ACTS-AS is deprecated, please provide the ID of the timeCard owner through userId property.
Example
Old
POST /teams/{teamId}/schedule/timeCards
MS-APP-ACTS-AS: d56f3e8a-2b0f-42b1-88b9-e2dbd12a34d2
Content-Type: application/json
{
"clockInEvent": {
"dateTime": "2025-01-07T21:00:00.000Z",
"isAtApprovedLocation": true
},
"clockOutEvent": {
"dateTime": "2025-01-07T21:30:00.000Z",
"isAtApprovedLocation": true
}
}
New
POST /teams/{teamId}/schedule/timeCards
Content-Type: application/json
{
“userId”: “d56f3e8a-2b0f-42b1-88b9-e2dbd12a34d2”,
"clockInEvent": {
"dateTime": "2025-01-07T21:00:00.000Z",
"isAtApprovedLocation": true
},
"clockOutEvent": {
"dateTime": "2025-01-07T21:30:00.000Z",
"isAtApprovedLocation": true
}
}
0 comments
Be the first to start the discussion.