Overview
The Microsoft Teams Internal User Search monitoring test appears in the Microsoft Teams section of the Office 365, ECLOUD-INTERNET and Remote Probe monitoring nodes.
Monitoring Benefit
The Microsoft Teams Internal User Search test verifies that a directory search for a known user returns that user through Microsoft Graph, and that the same user can also be retrieved by a direct lookup — confirming the directory readiness that Teams user discovery depends on.
This is a Graph and directory readiness test supporting Teams user discovery. It is not a validation of search inside the Teams client, and a pass here does not guarantee that the Teams client search experience is healthy.
How do we verify the monitoring test results?
1. Confirm the monitoring credential is valid.
For the Office 365 and ECLOUD-INTERNET monitoring tests, navigate to Server > Tuning Policy > Settings > Office 365 > Microsoft Teams > Microsoft Teams User > Verify Credential.
For the Remote Probe monitoring tests, navigate to Server > Tuning Policy > Settings > Probe Configuration > Configure Probes… > Default Office 365 Settings > Microsoft Teams > Verify Credential.
2. Reproduce the directory search manually.
Using the same application registration, run the two Graph calls the test performs. The search call requires the ConsistencyLevel: eventual header — without it Graph rejects $search, and the failure will look like a search failure rather than a malformed request.
GET https://graph.microsoft.com/v1.0/users?$search="displayName:{known user}"&$top=1
Header: ConsistencyLevel: eventual
GET https://graph.microsoft.com/v1.0/users/{known user UPN}Prerequisites
This test authenticates through an enterprise application registered in Microsoft Entra ID, acquiring a token from login.microsoftonline.com and calling Microsoft Graph at graph.microsoft.com.
The enterprise application requires one of the following Microsoft Graph application permissions, admin-consented in the tenant:
User.Read.All, orDirectory.Read.All
If the permission is present but has not been granted admin consent, the test reports a permission failure rather than an authentication failure.
Common warning or error results, and potential solutions
| Result | Potential solution |
| Authentication failure | Token acquisition failed or Graph returned 401. Re-run Verify Credential using the path above. Confirm the client secret or certificate has not expired. |
| Permission failure | Graph returned 403. Confirm the application has User.Read.All or Directory.Read.All granted and admin-consented. |
| Search failure | The directory search call did not succeed. Confirm the ConsistencyLevel: eventual header is being sent; $search is rejected without it. |
| Expected user not found | The search returned successfully but the configured target user was not in the results. Confirm the target user still exists and the configured identifier matches. |
| Direct lookup failure | The direct user lookup did not succeed although the search did. Confirm the configured UPN or object ID is still correct. |
| Search consistency delay | The direct lookup found the user but the search did not. This is normally a directory indexing delay after a recent change rather than a fault; confirm whether the target user was created or renamed recently. |
| Throttling | Graph returned 429. The test honours Retry-After and retries before reporting. Persistent throttling suggests other applications are consuming the tenant's Graph quota. |
| Timeout | A call exceeded the configured per-call timeout with no response. Check outbound connectivity from the monitoring node to the Graph endpoint. |
| Unknown error | A failure outside the categories above, typically an unexpected 5xx after retries. Review the recorded HTTP status and Graph error code in the test detail. |
Related monitoring tests
- Microsoft Teams - Chat Status — sign-in and chat readiness for the same synthetic user.
- Microsoft Teams - Online Meeting — Teams meeting control plane, independent of Exchange.
Comments
0 comments
Please sign in to leave a comment.