Notice that your last call, the one to "serviceurl", is NOT part of the Graph, obviously. As a result, it's authentication is different. In this case, Teams is authenticating it as a bot, and it needs certain rights. For instance, the bot MUST be installed to the Team in question in order to get the roster for that Team. You say it was working before - is that in the same Team? If not, the bot needs to be added to that Team. If "yes", then perhaps the bot was removed from the Team by someone?
