Access tenants Microsoft Graph from daemon app

Question

I am developing a daemon app that interacts with Microsoft 365 Office Planner to manipulate Microsoft Graph tasks. When I call the Microsoft Graph API to get the tasks related to my tenant, I get an Unauthorized request exception.

I have registered my application in Azure Active Directory and also gave it permissions to use the Microsoft Graph.

I request an access token based on the process from here: https://graph.microsoft.io/en-us/docs/authorization/app_only

I am able to get a token from the Azure Active Directory v2.0 endpoint. The request code is the following:

 new KeyValuePair<string, string>("grant_type", "client_credentials"),
         new KeyValuePair<string, string>("client_id", "<clent id>"),
         new KeyValuePair<string, string>("client_secret", "<client secret>"),
         new KeyValuePair<string, string>("resource", @"https://graph.microsoft.com")
     var content = new FormUrlEncodedContent(pairs);

     var response = client.PostAsync("https://login.microsoftonline.com/<tenant id>/oauth2/token", content).Result;

When I use this access token to perform a request as follow:

     client.DefaultRequestHeaders.Authorization= new AuthenticationHeaderValue("Bearer", token);

     client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/x-www-form-urlencoded"));

     var response = client.GetAsync(@"https://graph.microsoft.com/beta/tasks").Result;

I get a status code 401 Unauthorized with the following response message:

Unauthorized: Access is denied due to invalid credentials.
You do not have permission to view this directory or page using the credentials that you supplied.

Is there any authorization process I have not performed to grant access to my app. Please help!!!!

Thanks in advance!!

Fei Xue - MSFT Fei Xue - MSFT · Accepted Answer · 2017-01-27T02:58:33

Based on the test, it seems that Microsoft Graph doesn't support to list tasks with app-only token. After I grant the Group.ReadAll app permission to the app, I got the error like below with the request:

GET:https://graph.microsoft.com/beta/tasks?$filter=createdBy+eq+'[email protected]'

However the request was called successfully with the delegate-token with same permission:

As a workaround, you may check whether the OAuth2 Code Grant flow is helpful for your scenario.

The other users have raised the feedback about listing the tasks using the app-only token, you can vote this feedback from here if you also want this feature.

Access tenants Microsoft Graph from daemon app

1 Answers