Azure AD / Microsoft.Graph C# Authorization problem, but not in Graph Explorer

0
votes

Hi all and thanks in advance for all feedback. It is much appreciated!

I use NuGet packages: Microsoft.Graph 3.27.0 Micfosoft.Graph.Auth 1.0.0

and OnBehalfOfProvider and basically just want to list users or filter to a specific one from Azure Active Directory, but I can't seem to figure out how to do the same as I am allowed to with Graph Explorer (https://developer.microsoft.com/en-us/graph/graph-explorer). With the online explorer I have no issues:

Everything fine with Graph Explorer and listing users

But in my C# .NET application when I try to do the same with scopes parameter: string[] graphScopes = { "User.Read","profile", "Sites.ReadWrite.All"}; or string[] graphScopes = { "https://graph.microsoft.com/user.read+offline_access"};

I get Status 500 Internal Server Error and these details:

"error": { "code": "generalException", "message": "Unexpected exception returned from MSAL." ... "innerException": { "classification": 4, "statusCode": 400, "claims": null, "responseBody": "{"error":"invalid_grant","error_description":"AADSTS65001: The user or administrator has not consented to use the application with ID 'c0fb187f-daa8-4566-a7fb-2decd05ef980' named 'platform-test-ad'. Send an interactive authorization request for this user and resource.

And with scopes parameter: string[] graphScopes = new string[] { "https://graph.microsoft.com/.default" };

I get 403:

"error": { "code": "Authorization_RequestDenied", "message": "Insufficient privileges to complete the operation.", ... "statusCode": 403, "rawResponseBody": "{\r\n "error": {\r\n "code": "Authorization_RequestDenied",\r\n "message": "Insufficient privileges to complete the operation."

Inside Azure, Enterprice applications | User settings looks like this: Enterprice applications User settings

and my C# code looks like this:

IConfidentialClientApplication confidentialClientApplication = ConfidentialClientApplicationBuilder
                    .Create(authSettings.FunctionApplicationId)
                    .WithTenantId(authSettings.FunctionTenantId)
                    .WithAuthority(authSettings.Authority)
                    .WithClientSecret(authSettings.FunctionClientSecret)
                    .Build();
                string[] graphScopes = new string[] { "https://graph.microsoft.com/user.read+offline_access" };
                OnBehalfOfProvider authProvider = new OnBehalfOfProvider(confidentialClientApplication, graphScopes);

            var userAssertion = new UserAssertion(token);
            var usersRequest = confidentialClientApplication.Users
                .Request()
                .WithUserAssertion(userAssertion);
            var usersResult = await usersRequest.GetAsync();

Any tips or explanation on this?

3
c#.netazurevisual-studioactive-directory

3 Answers

0
votes

It turnes out that Pamela's answer was half of the answer, but it lead me to the solution. I also needed to add permissions inside API permissions like this: API App Permissions

And to read single user, all users and create users inside Azure Active directory, I use this scope:

string[] graphScopes = { "User.ReadWrite.All" };

But for the above example you're right, "User.Read.All" was enough.

0
votes

Make sure your account is not a personal(invited) account when calling Microsoft Graph API to list users.

And you need to add one of the delegated permission in API Permission from Azure portal, such as User.Read.All. The scope User.Read in your issue has not enough permissions.

enter image description here

string[] graphScopes = new string[] { "User.Read.All" };
OnBehalfOfProvider authProvider = new OnBehalfOfProvider(confidentialClientApplication, graphScopes);
GraphServiceClient graphClient = new GraphServiceClient( authProvider );

var users = await graphClient.Users
    .Request()
    .GetAsync();

Add: click grant admin consent for your tenant in API permission, because the User.Read.All requires admin consent.

-1
votes

I had some AADSTS65001 in the past with MSAL on AcquireTokenSilent when the scope where not fully written. For Powerbi I had to change

App.Read.All

to

https://analysis.windows.net/powerbi/api/App.Read.All

Strangely the authenticate cycle was was perfectly working without this change (consent in particular) but failing only on AcquireTokenSilent.