Graph retention events API returns 500 "DataInsightsRequestError - Forbidden" even with delegated permission

Open a Microsoft support case for a Graph-to-Purview backend authorization failure; the documented API contract supports both delegated and application RecordsManagement.ReadWrite.All, so your successful portal access plus identical app-only and delegated failures leaves no documented tenant-side Graph permission fix.

Why this points to the service backend

The stable v1.0 contracts explicitly support:

• GET /security/triggerTypes/retentionEventTypes with delegated or application RecordsManagement.Read.All or RecordsManagement.ReadWrite.All.^1^
• GET /security/triggers/retentionEvents with the same delegated or application permissions.^2^
• POST /security/triggers/retentionEvents with delegated or application RecordsManagement.ReadWrite.All.^3^
• POST /security/triggerTypes/retentionEventTypes with delegated or application RecordsManagement.ReadWrite.All.^4^

Those contracts do not document a Global Administrator requirement. Because both authentication modes fail during even a collection GET, changing the POST body, SDK, secret, certificate, or Graph API version is unlikely to address this failure.

The same DataInsights command(GET) FAILED - Forbidden signature has been reported for the adjacent Purview retention-label API. In that case, Microsoft support reproduced an undocumented dependency on Global Administrator and characterized it as potentially internal to the endpoint.^5^ That report is not proof that retention-event endpoints have the same dependency, so Global Administrator should not be treated as the permanent fix.

Support case details

Include the following for one delegated and one application request:

1. UTC timestamp.
2. Graph request-id and client-request-id from the response.
3. Tenant cloud and region, without posting the tenant ID publicly.
4. Exact v1.0 method and URL.
5. Full sanitized error showing:
   • DataInsightsRequestError
   • DataInsights command(GET) FAILED - Forbidden
   • the PROD.OUTLOOK.COM target
6. Confirmation that:
   • application and delegated RecordsManagement.ReadWrite.All are admin-consented;
   • the delegated token contains the scope;
   • the user can create the same event types and events in Purview;
   • both v1.0 and beta produce the same result.

Ask support to investigate authorization between Microsoft Graph Records Management and DataInsights/EOP rather than app consent.

Temporary diagnostic only: Global Administrator

If your security policy permits it, support might ask for one controlled delegated test with a temporarily activated Global Administrator account because the matching retention-label incident succeeded only under that role.^5^

Use just the read request, then remove/deactivate the role immediately:

GET https://graph.microsoft.com/v1.0/security/triggerTypes/retentionEventTypes
Authorization: Bearer <delegated-token>

This is a diagnostic, not a recommended automation design. Microsoft recommends least privilege and minimizing Global Administrator assignments; for normal records-management administration, the recommended Purview role group is Records Management.^6^

• If it succeeds only as Global Administrator, attach that comparison to the support case as evidence of an undocumented role dependency.
• If it still fails, stop role testing; the result further isolates the problem to tenant/service-side processing.

Licensing and supported workarounds

Event-based records management does have feature-level licensing requirements, but the exact applicable subscription depends on the features and users involved.^6^ Since the same user can already create events in Purview, the available evidence does not establish licensing as the cause. Support can confirm tenant entitlements during escalation.

There is no other documented REST interface to substitute for Graph: the older REST automation method is deprecated and no longer works. Microsoft documents these supported automation methods:

• Microsoft Graph Records Management APIs.
• Security & Compliance PowerShell cmdlets, including New-ComplianceRetentionEvent and New-ComplianceRetentionEventType.^7^

For immediate operation without PowerShell, use the Purview portal at Solutions → Records Management → Events → Create. For unattended automation while the Graph path is investigated, Security & Compliance PowerShell is the documented fallback; New-ComplianceRetentionEvent is available only in that PowerShell environment and requires the corresponding Purview permissions.^8^

References

1. List retentionEventTypes
2. List retentionEvents
3. Create retentionEvent
4. Create retentionEventType
5. RetentionLabels - (500) Exception = DataInsights command(GET) FAILED - Forbidden - Microsoft Q&A
6. Get started with records management
7. Start retention when an event occurs
8. New-ComplianceRetentionEvent-Syntax