0

I am trying to call graph api URL https://graph.microsoft.com/v1.0/me from a native application but get access denied.

If I call web api authorized controller from the native app, I successfully authenticate.

When I try to make a REST call in the backend, I also get access denied (providing user's token).

I have tried to implement it via HttpClient class (for the native app), and adal.js for the front-end - in both cases I successfully authenticate against the web api controllers decorated with Authorized attribute, but cannot call Graph API service.

I have run a web debugging proxy and ensured that the authorization header is sent properly.

I have done the following:

  1. Created Azure Native App
  2. Created Azure Web App

  3. Provided permissions of the native app to the web api app

    a. Added Read Directory Data permissions to the default permissions

  4. Entered redirect URI in the Native app - same URL as the one of the Web API

  5. Updated the Web app manifest from Azure AD. Set oauth2AllowImplicitFlow to true

  6. Provided permissions of the web app

    Windows Azure Active Directory:

    a. Application Permissions - Read Directory Data

    b. Delegated Permissions: Access directory as signed-in user

    c. Delegated Permissions: Read Directory Data

    d. Delegated Permissions: Sign in and read user profile

    Microsoft Graph:

    a. Delegated Permissions: Sign users in

    b. Delegated Permissions: Access Directory as signed in user

    c. Delegated Permissions: Read Directory Data

    d. Delegated Permissions: Read all users' full profiles

    e. Delegated Permissions: Sign in and read user profile

    f. Application Permissions: Read directory data

    g. Application Permissions: Read all users' full profiles

  7. Consented the native app successfully

  8. Consented the web api app successfully
Kiril Iliev
  • 103
  • 10
  • 1
    How you acquire the token for the Microsoft Graph? And you can check the token form [here](https://jwt.io/) to see whether the `aud` claim is `https://graph.microsoft.com`? And to call this REST API, the following scope is required : User.Read; User.ReadWrite; User.ReadBasic.All; User.Read.All; User.ReadWrite.All; Directory.Read.All; Directory.ReadWrite.All; Directory.AccessAsUser.All – Fei Xue Oct 27 '16 at 06:11
  • Thanks for the tool. This actually helped me to troubleshoot the problem. It was due to wrong audience - https://graph.microsoft.NET instead of COM. All working good now! – Kiril Iliev Oct 27 '16 at 08:43

0 Answers0