Graph API returns 404 for Partner Security subjects that are documented as available

/security/partner/securityScore/history and /security/partner/securityScore/requirements are part of the Microsoft Graph beta partner security score API in the microsoft.graph.partner.security namespace.

From the documentation:

• These APIs are under /beta and are subject to change.
• Use of these APIs in production applications is not supported.

For partnerSecurityScore the documented methods include:

• GET /security/partner/securityScore (works in the described scenario)
• GET /security/partner/securityScore/customerInsights
• GET /security/partner/securityScore/history
• GET /security/partner/securityScore/requirements

The requirements method is documented as:

GET /security/partner/securityScore/requirements

with the following permission requirements:

• Delegated: PartnerSecurity.Read.All (least privileged) or PartnerSecurity.ReadWrite.All
• Application: PartnerSecurity.Read.All (least privileged) or PartnerSecurity.ReadWrite.All

Given that:

• The tenant is CSP and can successfully call partnerSecurityScore and customerInsights with the same token, and
• history and requirements are documented beta endpoints,

the 404 behavior is consistent with beta APIs that are:

• Not yet fully deployed or enabled for all tenants/regions, or
• Temporarily unavailable or changed while the documentation still reflects the intended contract.

In other words, the methods are documented as available, but as beta endpoints they can legitimately return 404 even when other partner security score calls succeed. This is not necessarily a token/permission issue if the same token works for the other partner security score operations.

The supported and stable way to work with partner security posture today is primarily via:

• The partnerSecurityScore root resource and its working navigation properties.
• The Partner Center Security workspace (Security requirements dashboard, Security alerts, MFA statistics) for operational use.

For this specific 404 on beta endpoints, the next step is to treat it as a beta-platform limitation or rollout gap rather than a misconfiguration in the application.

References:

• Use the partner security score API in Microsoft Graph (preview)
• List requirements
• partnerSecurityScore resource type
• What is the Security workspace?