Choosing the right Azure AD auth version when calling Microsoft Graph

Question

I'm new to the Microsoft Graph API and Azure. I'd like to seek advises to which Microsoft Graph API version I should go with and whether I should be using the "Web API on-behalf-of flow" for my scenario.

I'm building a web services which can store access tokens of multiple Office 365 users from different organisations. This web services can then create web hooks via the Microsoft Graph API to get notifications about calendar appointment changes in these users' accounts, in order to sync these changes to the corresponding appointments stored on our own server.

So it's a mass Office 365 calendar syncing web service in a nut shell.

I have gone through a lot of their GitHub sample projects and managed to create web hooks with the v1 graph subscription API and was able to interact with the calendar of my dev account, all in a sample APS.NET MVC project.

But I'm very confused about the following parts:

1. Because this web service does not directly provide a UI, so the login UI would be presented by a separate desktop (WPF) client, and I believe when this is done on the client side, I can forward the authenticated access token to my web service to create the web hooks? This sounds like the "Web API on-behalf-of flow" scenario Microsoft described here: https://docs.microsoft.com/en-au/azure/active-directory/develop/active-directory-v2-limitations.
2. Because this web service needs to create web hooks to multiple Office 365 accounts from different organisations. I'm not sure if this counts as the a multi-tenant scenario. If this is the case, it looks like I can only use the v1 API because the v2 API only allows the web service to receive tokens from an application that has the same application ID (also described in the page linked above).

Microsoft Graph and Azure AD developers could you please shed some light on this part for me? Microsoft isn't doing the best job when it comes to documenting these parts.

Answer 1

Because this web service does not directly provide a UI, so the login UI would be presented by a separate desktop (WPF) client, and I believe when this is done on the client side, I can forward the authenticated access token to my web service to create the web hooks? This sounds like the "Web API on-behalf-of flow" scenario Microsoft described here: https://docs.microsoft.com/en-au/azure/active-directory/develop/active-directory-v2-limitations.

Yes, the scenario is on-behalf-of flow and this flow is not supported for the v2.0 endpoint at present.

Because this web service needs to create web hooks to multiple Office 365 accounts from different organisations. I'm not sure if this counts as the a multi-tenant scenario. If this is the case, it looks like I can only use the v1 API because the v2 API only allows the web service to receive tokens from an application that has the same application ID (also described in the page linked above).

You can only use Azure AD V1 endpoint, because the V2.0 endpoint doesn't support on-behalf-of flow. And here are some steps for using V1 endpoint for your reference:

1. register 2 apps, one for the WPF(native app) and one for your web service(web app)
2. enable the multi-tenant for the app for web service
3. grant the relative Microsoft Graph permission to the web app
4. set the knownClientApplications for the web app using the clientId of the native app
5. grant the relative Microsoft Graph permission and web app to the native app

After that, when the users login-in in WPF first time in different tenant, the users can conesent the two apps at same time. And then the service principals of two apps will be register to users' tenant. After that the web service can use the on-behalf-of flow to get the access_token for Microsoft Graph based on the token from native app.

More detail about multi-tenant developing, please refer below:

How to sign in any Azure Active Directory (AD) user using the multi-tenant application pattern

And the code sample below also be helpful:

Calling a downstream web API from a web API using Azure AD