{"id":24410,"date":"2025-06-23T08:30:30","date_gmt":"2025-06-23T15:30:30","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/?p=24410"},"modified":"2025-06-30T03:59:55","modified_gmt":"2025-06-30T10:59:55","slug":"deprecation-of-ms-app-acts-as-header-in-shifts-management-microsoft-graph-apis","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/deprecation-of-ms-app-acts-as-header-in-shifts-management-microsoft-graph-apis\/","title":{"rendered":"Deprecation of MS-APP-ACTS-AS header in Shifts Management Microsoft Graph APIs"},"content":{"rendered":"<p>In app-only access scenarios, <a href=\"https:\/\/learn.microsoft.com\/en-us\/graph\/api\/resources\/shift?view=graph-rest-1.0\">Shifts Management Graph APIs<\/a> previously required the MS-APP-ACTS-AS: userId header to indicate the user on whose behalf the application was acting. However, this conflicted with the <a href=\"https:\/\/learn.microsoft.com\/en-us\/graph\/permissions-overview?tabs=http\">Microsoft Graph permission model<\/a> where there is no signed-in user for app-only access scenarios. To align Shifts Graph APIs with this model, the MS-APP-ACTS-AS header has now been deprecated.<\/p>\n<h2>What Action You Need to Take<\/h2>\n<h3>If you don\u2019t send the header today<\/h3>\n<p>There is no impact. No changes are necessary.<\/p>\n<h3>If you send the header today<\/h3>\n<p>1. Please remove the header.<\/p>\n<p>Example:<\/p>\n<p>Old:<\/p>\n<p><code>GET \/teams\/{teamId}\/schedule\/shifts<\/code><\/p>\n<p><code>MS-APP-ACTS-AS: d56f3e8a-2b0f-42b1-88b9-e2dbd12a34d2<\/code><\/p>\n<p>New:<\/p>\n<p><code>GET \/teams\/{teamId}\/schedule\/shifts<\/code><\/p>\n<p>2. For <a href=\"https:\/\/learn.microsoft.com\/en-us\/graph\/api\/resources\/offershiftrequest\">offerShiftRequest<\/a>, <a href=\"https:\/\/learn.microsoft.com\/en-us\/graph\/api\/resources\/openshiftchangerequest\">openShiftsChangeRequest<\/a>, <a href=\"https:\/\/learn.microsoft.com\/en-us\/graph\/api\/resources\/swapshiftschangerequest\">swapShiftsChangeRequest<\/a>, <a href=\"https:\/\/learn.microsoft.com\/en-us\/graph\/api\/resources\/timeoffrequest?view=graph-rest-1.0\">timeOffRequest<\/a>, or\u00a0<a href=\"https:\/\/learn.microsoft.com\/en-us\/graph\/api\/resources\/timecard\">timeCard,<\/a> you may need to switch to a new API or add an additional property in the request body. Please see the instructions below.<\/p>\n<p><strong>ScheduleChangeRequest (offerShiftRequest, openShiftsChangeRequest, swapShiftsChangeRequest, timeOffRequest)<\/strong><\/p>\n<p><strong>Approve a ScheduleChangeRequest<\/strong><\/p>\n<ul>\n<li>If you are using \/approve API with application permissions, please use \/approveForUser instead.<\/li>\n<li>Eventually, \/approve will only support delegated permissions<\/li>\n<\/ul>\n<table style=\"width: 123%;\">\n<thead>\n<tr>\n<th style=\"width: 22.8024%;\"><strong>Old API<\/strong><\/th>\n<th style=\"width: 76.5883%;\"><strong>New API<\/strong><\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"width: 22.8024%;\"><a href=\"https:\/\/learn.microsoft.com\/en-us\/graph\/api\/offershiftrequest-approve\">teams\/{teamId}\/schedule\/offerShiftRequests\/{requestId}\/approve<\/a><\/td>\n<td style=\"width: 76.5883%;\"><a href=\"https:\/\/learn.microsoft.com\/en-us\/graph\/api\/schedulechangerequest-approveForUser\">teams\/{teamId}\/schedule\/offerShiftRequests\/{requestId}\/approveForUser<\/a><\/td>\n<\/tr>\n<tr>\n<td style=\"width: 22.8024%;\"><a href=\"https:\/\/learn.microsoft.com\/en-us\/graph\/api\/openshiftchangerequest-approve\">teams\/{teamId}\/schedule\/openShiftsChangeRequests\/{requestId}\/approve<\/a><\/td>\n<td style=\"width: 76.5883%;\"><a href=\"https:\/\/learn.microsoft.com\/en-us\/graph\/api\/schedulechangerequest-approveForUser\">teams\/{teamId}\/schedule\/openShiftsChangeRequests\/{requestId}\/approveForUser<\/a><\/td>\n<\/tr>\n<tr>\n<td style=\"width: 22.8024%;\"><a href=\"https:\/\/learn.microsoft.com\/en-us\/graph\/api\/swapshiftschangerequest-approve\">teams\/{teamId}\/schedule\/swapShiftsChangeRequests\/{requestId}\/approve<\/a><\/td>\n<td style=\"width: 76.5883%;\"><a href=\"https:\/\/learn.microsoft.com\/en-us\/graph\/api\/schedulechangerequest-approveForUser\">teams\/{teamId}\/schedule\/swapShiftsChangeRequests\/{requestId}\/approveForUser<\/a><\/td>\n<\/tr>\n<tr>\n<td style=\"width: 22.8024%;\"><a href=\"https:\/\/learn.microsoft.com\/en-us\/graph\/api\/timeoffrequest-approve\">teams\/{teamId}\/schedule\/timeOffRequests\/{requestId}\/approve<\/a><\/td>\n<td style=\"width: 76.5883%;\"><a href=\"https:\/\/learn.microsoft.com\/en-us\/graph\/api\/schedulechangerequest-approveForUser\">teams\/{teamId}\/schedule\/timeOffRequests\/{requestId}\/approveForUser<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Example<\/p>\n<p>Old:<\/p>\n<p><code>POST \/teams\/{teamId}\/schedule\/timeOffRequests\/{requestId}\/approve<\/code><\/p>\n<p><code>MS-APP-ACTS-AS: d56f3e8a-2b0f-42b1-88b9-e2dbd12a34d2<\/code><\/p>\n<p><code>Content-type: application\/json<\/code><\/p>\n<p><code>{<\/code><\/p>\n<p><code>\"message\": \"approved\"<\/code><\/p>\n<p><code>}<\/code><\/p>\n<p>New:<\/p>\n<p><code>POST \/teams\/{teamId}\/schedule\/timeOffRequests\/{requestId}\/approveForUser<\/code><\/p>\n<p><code>Content-Type: application\/json<\/code><\/p>\n<p><code>{<\/code><\/p>\n<p><code>\"message\": \"approved\",<\/code><\/p>\n<p><code>\u201cuserId\u201d: \"d56f3e8a-2b0f-42b1-88b9-e2dbd12a34d2\"<\/code><\/p>\n<p><code>}<\/code><\/p>\n<h3><strong>Decline a ScheduleChangeRequest<\/strong><\/h3>\n<ul>\n<li>If you are using \/decline API with application permissions, please use \/declineForUser instead.<\/li>\n<li>Eventually, \/decline will only support delegated permissions<\/li>\n<\/ul>\n<table>\n<thead>\n<tr>\n<th><strong>Old API<\/strong><\/th>\n<th><strong>New API<\/strong><\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><a href=\"https:\/\/learn.microsoft.com\/en-us\/graph\/api\/offershiftrequest-decline\">teams\/{teamId}\/schedule\/offerShiftRequests\/{requestId}\/decline<\/a><\/td>\n<td><a href=\"https:\/\/learn.microsoft.com\/en-us\/graph\/api\/schedulechangerequest-declineforuser\">teams\/{teamId}\/schedule\/offerShiftRequests\/{requestId}\/declineForUser<\/a><\/td>\n<\/tr>\n<tr>\n<td><a href=\"https:\/\/learn.microsoft.com\/en-us\/graph\/api\/openshiftchangerequest-decline\">teams\/{teamId}\/schedule\/openShiftsChangeRequests\/{requestId}\/decline<\/a><\/td>\n<td><a href=\"https:\/\/learn.microsoft.com\/en-us\/graph\/api\/schedulechangerequest-declineforuser\">teams\/{teamId}\/schedule\/openShiftsChangeRequests\/{requestId}\/declineForUser<\/a><\/td>\n<\/tr>\n<tr>\n<td><a href=\"https:\/\/learn.microsoft.com\/en-us\/graph\/api\/swapshiftschangerequest-decline\">teams\/{teamId}\/schedule\/swapShiftsChangeRequests\/{requestId}\/decline<\/a><\/td>\n<td><a href=\"https:\/\/learn.microsoft.com\/en-us\/graph\/api\/schedulechangerequest-declineforuser\">teams\/{teamId}\/schedule\/swapShiftsChangeRequests\/{requestId}\/declineForUser<\/a><\/td>\n<\/tr>\n<tr>\n<td><a href=\"https:\/\/learn.microsoft.com\/en-us\/graph\/api\/timeoffrequest-decline\">teams\/{teamId}\/schedule\/timeOffRequests\/{requestId}\/decline<\/a><\/td>\n<td><a href=\"https:\/\/learn.microsoft.com\/en-us\/graph\/api\/schedulechangerequest-declineforuser\">teams\/{teamId}\/schedule\/timeOffRequests\/{requestId}\/declineForUser<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Example<\/p>\n<p>Old:<\/p>\n<p><code>POST \/teams\/{teamId}\/schedule\/timeOffRequests\/{requestId}\/decline<\/code><\/p>\n<p><code>MS-APP-ACTS-AS: d56f3e8a-2b0f-42b1-88b9-e2dbd12a34d2<\/code><\/p>\n<p><code>Content-type: application\/json<\/code><\/p>\n<p><code>{<\/code><\/p>\n<p><code>\"message\": \"declined\"<\/code><\/p>\n<p><code>}<\/code><\/p>\n<p>New:<\/p>\n<p><code>POST \/teams\/{teamId}\/schedule\/timeOffRequests\/{requestId}\/declineForUser<\/code><\/p>\n<p><code>Content-Type: application\/json<\/code><\/p>\n<p><code>{<\/code><\/p>\n<p><code>\"message\": \"declined\",<\/code><\/p>\n<p><code>\u201cuserId\u201d: \"d56f3e8a-2b0f-42b1-88b9-e2dbd12a34d2\"<\/code><\/p>\n<p><code>}<\/code><\/p>\n<h3>Create a TimeOffRequest<\/h3>\n<ul>\n<li><a href=\"https:\/\/learn.microsoft.com\/en-us\/graph\/api\/timeoffrequest-post\">POST teams\/{teamId}\/schedule\/timeOffRequests<\/a><\/li>\n<li>Previously,\u00a0senderUserId\u00a0was an optional property as the value provided by MS-APP-ACTS-AS was used as the sender user ID. Since MS-APP-ACTS-AS is deprecated, please provide the sender user ID through\u00a0senderUserId\u00a0property.<\/li>\n<li>Example<\/li>\n<\/ul>\n<p>Old:<\/p>\n<p><code>POST teams\/{teamId}\/schedule\/timeOffRequests<\/code><\/p>\n<p><code>MS-APP-ACTS-AS: d56f3e8a-2b0f-42b1-88b9-e2dbd12a34d2<\/code><\/p>\n<p><code>Content-type: application\/json<\/code><\/p>\n<p><code>{<\/code><\/p>\n<p><code>\"timeOffReasonId\": \"TOR_08c42f26-9b83-492c-bf52-f3609eb083e3\",<\/code><\/p>\n<p><code>\"startDateTime\": \"2025-05-26T07:00:00Z\",<\/code><\/p>\n<p><code>\"endDateTime\": \"2025-05-27T07:00:00Z\"<\/code><\/p>\n<p><code>}<\/code><\/p>\n<p>New:<\/p>\n<p><code>POST teams\/{teamId}\/schedule\/timeOffRequests<\/code><\/p>\n<p><code>Content-type: application\/json<\/code><\/p>\n<p><code>{<\/code><\/p>\n<p><code>\"timeOffReasonId\": \"TOR_08c42f26-9b83-492c-bf52-f3609eb083e3\",<\/code><\/p>\n<p><code>\"startDateTime\": \"2025-05-26T07:00:00Z\",<\/code><\/p>\n<p><code>\"endDateTime\": \"2025-05-27T07:00:00Z\",<\/code><\/p>\n<p><code>\"senderUserId\": \"3f2504e0-4f89-11d3-9a0c-0305e82c3301\"<\/code><\/p>\n<p><code>}<\/code><\/p>\n<h3>Create an OpenShiftsChangeRequest<\/h3>\n<ul>\n<li><a href=\"https:\/\/learn.microsoft.com\/en-us\/graph\/api\/openshiftchangerequest-post\">POST \/teams\/{teamId}\/schedule\/openShiftChangeRequests<\/a><\/li>\n<li>Previously, senderUserId was an optional property as the value provided by MS-APP-ACTS-AS was used as the sender user ID. Since MS-APP-ACTS-AS is deprecated, please provide the sender user ID through senderUserId property.<\/li>\n<\/ul>\n<p>Example<\/p>\n<p>Old<\/p>\n<p><code>POST teams\/{teamId}\/schedule\/openShiftChangeRequests<\/code><\/p>\n<p><code>MS-APP-ACTS-AS: d56f3e8a-2b0f-42b1-88b9-e2dbd12a34d2<\/code><\/p>\n<p><code>Content-type: application\/json<\/code><\/p>\n<p><code>{<\/code><\/p>\n<p><code>\"senderMessage\": \"Can I take this shift?\",<\/code><\/p>\n<p><code>\"openShiftId\": \"577b75d2-a927-48c0-a5d1-dc984894e7b8\"<\/code><\/p>\n<p><code>}<\/code><\/p>\n<p>New<\/p>\n<p><code>POST teams\/{teamId}\/schedule\/openShiftChangeRequests<\/code><\/p>\n<p><code>Content-type: application\/json<\/code><\/p>\n<p><code>{<\/code><\/p>\n<p><code>\"senderMessage\": \"Can I take this shift?\",<\/code><\/p>\n<p><code>\"openShiftId\": \"577b75d2-a927-48c0-a5d1-dc984894e7b8\",<\/code><\/p>\n<p><code>\"senderUserId\": \"d56f3e8a-2b0f-42b1-88b9-e2dbd12a34d2\"<\/code><\/p>\n<p><code>}<\/code><\/p>\n<h2>TimeCard<\/h2>\n<h3>Confirm a TimeCard<\/h3>\n<ul>\n<li>Please use \/confirmForUser instead of \/confirm.<\/li>\n<\/ul>\n<table>\n<thead>\n<tr>\n<th><strong>Old API<\/strong><\/th>\n<th><strong>New API<\/strong><\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><a href=\"https:\/\/learn.microsoft.com\/en-us\/graph\/api\/timecard-confirm\">teams\/{teamId}\/schedule\/timeCards\/{timeCardId}\/confirm<\/a><\/td>\n<td><a href=\"https:\/\/learn.microsoft.com\/en-us\/graph\/api\/timecard-confirmforuser\">teams\/{teamId}\/schedule\/timeCards\/{timeCardId}\/confirmForUser<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Example:<\/p>\n<p>Old<\/p>\n<p><code>POST teams\/{teamId}\/schedule\/timeCards\/{timeCardId}\/confirm<\/code><\/p>\n<p><code>MS-APP-ACTS-AS: d56f3e8a-2b0f-42b1-88b9-e2dbd12a34d2<\/code><\/p>\n<p>New<\/p>\n<p><code>POST teams\/{teamId}\/schedule\/timeCards\/{timeCardId}\/confirmForUser<\/code><\/p>\n<p><code>Content-Type: application\/json<\/code><\/p>\n<p><code>{<\/code><\/p>\n<p><code>\u201cuserId\u201d: \"d56f3e8a-2b0f-42b1-88b9-e2dbd12a34d2\"<\/code><\/p>\n<p><code>}<\/code><\/p>\n<h3>Clock in a TimeCard<\/h3>\n<ul>\n<li><a href=\"https:\/\/learn.microsoft.com\/en-us\/graph\/api\/timecard-clockin\">POST teams\/{teamId}\/schedule\/timeCards\/clockIn<\/a><\/li>\n<li>Previously,\u00a0onBehalfOfUserId\u00a0was an optional property as the value provided by MS-APP-ACTS-AS was used as the ID of the user that is clocking in. Since MS-APP-ACTS-AS is deprecated, please provide the ID of the user that is clocking in through\u00a0onBehalfOfUserId\u00a0property.<\/li>\n<li>Example:<\/li>\n<\/ul>\n<p>Old<\/p>\n<p><code>POST teams\/{teamId}\/schedule\/timeCards\/clockIn<\/code><\/p>\n<p><code>MS-APP-ACTS-AS: d56f3e8a-2b0f-42b1-88b9-e2dbd12a34d2<\/code><\/p>\n<p>New<\/p>\n<p><code>POST teams\/{teamId}\/schedule\/timeCards\/clockIn<\/code><\/p>\n<p><code>Content-type: application\/json<\/code><\/p>\n<p><code>{<\/code><\/p>\n<p><code>\"onBehalfOfUserId\": \"3f29c8e7-7a41-4d8e-99d6-2b1f76c9421e\"<\/code><\/p>\n<p><code>}<\/code><\/p>\n<h3><strong>Create a TimeCard<\/strong><\/h3>\n<ul>\n<li><a href=\"https:\/\/learn.microsoft.com\/en-us\/graph\/api\/schedule-post-timecards\">POST \/teams\/{teamId}\/schedule\/timeCards<\/a><\/li>\n<li>Previously, userId was an optional property as the value provided by MS-APP-ACTS-AS was used as the ID of the owner of the timeCard. Since MS-APP-ACTS-AS is deprecated, please provide the ID of the timeCard owner through userId property.<\/li>\n<\/ul>\n<p>Example<\/p>\n<p>Old<\/p>\n<p><code>POST \/teams\/{teamId}\/schedule\/timeCards<\/code><\/p>\n<p><code>MS-APP-ACTS-AS: d56f3e8a-2b0f-42b1-88b9-e2dbd12a34d2<\/code><\/p>\n<p><code>Content-Type: application\/json<\/code><\/p>\n<p><code>{<\/code><\/p>\n<p><code>\"clockInEvent\": {<\/code><\/p>\n<p><code>\"dateTime\": \"2025-01-07T21:00:00.000Z\",<\/code><\/p>\n<p><code>\"isAtApprovedLocation\": true<\/code><\/p>\n<p><code>},<\/code><\/p>\n<p><code>\"clockOutEvent\": {<\/code><\/p>\n<p><code>\"dateTime\": \"2025-01-07T21:30:00.000Z\",<\/code><\/p>\n<p><code>\"isAtApprovedLocation\": true<\/code><\/p>\n<p><code>}<\/code><\/p>\n<p><code>}<\/code><\/p>\n<p>New<\/p>\n<p><code>POST \/teams\/{teamId}\/schedule\/timeCards<\/code><\/p>\n<p><code>Content-Type: application\/json<\/code><\/p>\n<p><code>{<\/code><\/p>\n<p><code>\u201cuserId\u201d: \u201cd56f3e8a-2b0f-42b1-88b9-e2dbd12a34d2\u201d,<\/code><\/p>\n<p><code>\"clockInEvent\": {<\/code><\/p>\n<p><code>\"dateTime\": \"2025-01-07T21:00:00.000Z\",<\/code><\/p>\n<p><code>\"isAtApprovedLocation\": true<\/code><\/p>\n<p><code>},<\/code><\/p>\n<p><code>\"clockOutEvent\": {<\/code><\/p>\n<p><code>\"dateTime\": \"2025-01-07T21:30:00.000Z\",<\/code><\/p>\n<p><code>\"isAtApprovedLocation\": true<\/code><\/p>\n<p><code>}<\/code><\/p>\n<p><code>}<\/code><\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In app-only access scenarios, Shifts Management Graph APIs previously required the MS-APP-ACTS-AS: userId header to indicate the user on whose behalf the application was acting. However, this conflicted with the Microsoft Graph permission model where there is no signed-in user for app-only access scenarios. To align Shifts Graph APIs with this model, the MS-APP-ACTS-AS header [&hellip;]<\/p>\n","protected":false},"author":191357,"featured_media":24468,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[3],"tags":[146],"class_list":["post-24410","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-microsoft-graph","tag-microsoft-graph-api"],"acf":[],"blog_post_summary":"<p>In app-only access scenarios, Shifts Management Graph APIs previously required the MS-APP-ACTS-AS: userId header to indicate the user on whose behalf the application was acting. However, this conflicted with the Microsoft Graph permission model where there is no signed-in user for app-only access scenarios. To align Shifts Graph APIs with this model, the MS-APP-ACTS-AS header [&hellip;]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/posts\/24410","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/users\/191357"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/comments?post=24410"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/posts\/24410\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/media\/24468"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/media?parent=24410"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/categories?post=24410"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/tags?post=24410"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}