 <p>The problem is connected with the agreements. Some users had logged in before we added new requirement and the login page (I do not know why) did not ask the new accept. So the graph api just blocked our requests of these user's security groups. </p>