2

I have a C# solution that I use to retrieve Mails via Microsoft Graph API. Currently I get the access token interactively via

var pcApplication = PublicClientApplicationBuilder.Create(clientId).Build();
AcquireTokenInteractiveParameterBuilder acquireTokenInteractiveParameterBuilder =
                        pcApplication.AcquireTokenInteractive(scopes);
                    acquireTokenInteractiveParameterBuilder.WithLoginHint(login);
                    acquireTokenInteractiveParameterBuilder.WithAuthority(authorityUri);
                    AuthenticationResult authResult = await acquireTokenInteractiveParameterBuilder.ExecuteAsync();

and aquire a new token silently with existing token like this:

var pcApplication = PublicClientApplicationBuilder.Create(clientId).Build();
AuthenticationResult authResult = await pcApplication.AcquireTokenSilent(scopes, login).ExecuteAsync();

My scopes are { "Mail.ReadWrite", "Mail.ReadWrite.Shared", "Mail.Send" }. I do not want to use Application permissions, but User delegated permissions.

Now I want to access a resource as an impersonated user in form of technicalUser@domain\impersonatedUser. But when I want to call graphclient.Users[User] where User is my impersonated user with the token Cache of the user, I get an error message saying I have not the right permissions.

Am I missing something in my scope or am I missing something in my code with the token flow?

0 Answers0