Permissions problems reading users from azure AD with User.ReadBasic.All?

user_12737559 0
Viewed 1439

I am trying to get azure users and i am getting permissions error, even if instead of Users i place ME, why ? shouldnt it be something that i had no need to have admin consent? Any help is appreciated!!


            IConfidentialClientApplication confidentialClientApplication = ConfidentialClientApplicationBuilder
                .Create("****")
                .WithTenantId("****")
                .WithClientSecret("***")
                .Build();

            ClientCredentialProvider authProvider = new ClientCredentialProvider(confidentialClientApplication);
            // Create a new instance of GraphServiceClient with the authentication provider.
            GraphServiceClient graphClient = new GraphServiceClient(authProvider);

            var user = await graphClient.Users
                .Request()
                .WithScopes(graphScopes)
                .Select(u => new {
                    u.DisplayName
                })
                .GetAsync();
    ```
azure-active-directory asp.net-core permissions c#
1 Answers

For this problem it seems you do not have permission to get the users. You can refer to the document of the graph api, you need the permission shown as below:

enter image description here

So please go to the application which registered in your azure ad, and click "API permissions", then add the permission into it.

enter image description here

enter image description here

After add the permissions, please do not forget click "Grand admin consent for xxx".

For the question why it still failed when you change the Users to me. You use client credential flow to do authentication to request the graph api, you just provide the information of clientId, tenantId and clientSecret. So it doesn't contain a user(or yourself) information. So you can't use .Me. If you want to use .Me, you can use password grant flow. It contains the user information, so system know who is .Me.

================================Update==============================

If you want to use delegated permission(such as User.ReadBasic.All), you can't use client_credential. Now your code use client_credential flow, the access token doesn't contain user identity. I provide a sample of username/password flow(and use delegated permission User.ReadBasic.All) below for your referencef:

In the "API permissions" tab of the registered app, I just add one permission User.ReadBasic.All.

enter image description here

The code shown as below:

using Microsoft.Graph;
using Microsoft.Graph.Auth;
using Microsoft.Identity.Client;
using System;
using System.Security;

namespace ConsoleApp3
{
    class Program
    {
        static async System.Threading.Tasks.Task Main(string[] args)
        {
            IPublicClientApplication publicClientApplication = PublicClientApplicationBuilder
            .Create("<clientId>")
            .WithTenantId("<tenantId>")
            .Build();

            string[] scopes = new string[] { "https://graph.microsoft.com/.default" };

            UsernamePasswordProvider authProvider = new UsernamePasswordProvider(publicClientApplication, scopes);

            GraphServiceClient graphClient = new GraphServiceClient(authProvider);

            var str = "<your password>";
            var password = new SecureString();
            foreach (char c in str) password.AppendChar(c);

            var users = await graphClient.Users.Request().WithUsernamePassword("<your account/email>", password).GetAsync();

            Console.WriteLine(users.Count);
        }
    }
}

And before run the code, you need to do "consent to use the application" once. You need to browse the url as this: https://login.microsoftonline.com/<tenantId>/oauth2/v2.0/authorize?client_id=<clientId>&response_type=code&redirect_uri=<redirectUri>&response_mode=query&scope=openid https://graph.microsoft.com/.default&state=12345 in your browser and the page will show as: enter image description here

Click "Accept", then you can run the code to get user list success.

user_110992130
Related