2

I am new to Microsoft Graph API. I have read many articles on the web to understand the usage of Microosft Garph API for managing users in Azure AD. I am creating a Springboot based REST API service, which needs to create users in Azure AD.

I have registered my application in Azure Active Directory. I have also 'Directory.ReadWrite.All" permission for Microsoft Graph API. I wanted to first try to create the user from Microsoft Garph explorer. In the Graph Explorer, I have to give authorization token in the Request header. In order to create authorization token, I have followed the instruction given in the link https://learn.microsoft.com/en-us/graph/auth-v2-user. I have created the following URL based on the instruction, for obtaining Access token.

https://login.microsoftonline.com/{mytenantID}/oauth2/v2.0/authorize?client_id=validclientID&response_type=code&redirect_uri=https://localhost:4200&response_mode=query&scope=Directory.ReadWrite.All&state=12345

When the above URL is accessed from the web browser, I get a message which says "Need Admin Approval". I am not the admin of the Azure AD and I do not have access to the admin of my client, so I am really stuck. Can anybody help me understand whether I will have to get admin consent each time I need to access "create user" functionality of Azure AD through MS Graph API? . I would also also need the create user functionaltiy in the Springboot API. In this case, how would Admin Consent work?. Is there anyway that the create user functionality can work without Admin consent.

I have read the following two questions in SO before posting this question

How can I find the Admin Consent URL for an Azure AD App that requires Microsoft Graph "Read directory data" permission?

Create user using Microsoft Graph

KurioZ7
  • 6,028
  • 13
  • 46
  • 65

1 Answers1

2

if you just want to create a user in your tenant , you can follow the steps below :

  1. Create a new Azure AD app in your tenant, ask your tenant admin to grant "Directory.ReadWrite.All" permission to this app : enter image description here

  2. Create a app secret for your Azure AD app : enter image description here Use this secret and this Azure AD app ID to get access_token to call Microsoft Graph API :

    Request URL :

    POST https://login.microsoftonline.com/<-your tenant name->/oauth2/v2.0/token

    Request Header :

    Content-Type: application/x-www-form-urlencoded

    Request Body:

grant_type:client_credentials

client_id:your client Id

client_secret: Your application secret

scope=https://graph.microsoft.com/.default

You will get an access_token from this API calling.

See the screen shot below:

enter image description here 3. Using the access_token we just created to call Microsoft Graph API to create a user :

enter image description here

As you can see , a user has been created :

enter image description here

If you have any further concerns , pls feel free to let me know : )

Md Farid Uddin Kiron
  • 16,817
  • 3
  • 17
  • 43
  • I created a POST request using Postman, but I am getting error": "invalid_request", "error_description": "AADSTS900144: The request body must contain the following parameter: 'grant_type'. I have given all the values in the request body as per what you have suggested – KurioZ7 May 08 '19 at 09:06
  • Yes, provide this `grant_type=client_credentials`. I have updated the answer see once more please. Let me know if you have any more concern. – Md Farid Uddin Kiron May 08 '19 at 09:21
  • I confirm that I have given the grant_type in the request body in Postman. I do not understand why I am getting this error when grant_type is present in the request body. – KurioZ7 May 08 '19 at 09:25
  • It worked, when I gave grant_type as the first key in the Body. Strange!. I will update you after I have tried the other steps. – KurioZ7 May 08 '19 at 09:28
  • Yes , Its the format, You have to follow it as it is. I have also update the answer for your understanding with the screen shot. – Md Farid Uddin Kiron May 08 '19 at 09:45
  • Big thanks to you!. I am able to create the user now. ! – KurioZ7 May 08 '19 at 11:04
  • @KurioZ7 Glad to hear. Thanks and happy coding. – Md Farid Uddin Kiron May 08 '19 at 13:15