使用服务主体登录Microsoft Graph / Office 365 REST API

Question

Is it possible to log into MS or Azure Graph or the Office 365 REST API using a service principal? I am currently working on a multi-tenant application and with OAuth I don't like that it is possible that my refresh token expires.

Answer 1

You can use certificate based application-based authentication.

When you have added an X.509 cert to the application's manifest, you should be able to use something like the following to get an application token. Bear in mind that this is an application login, so the permissions need to be on the application and not on the signed in user.

var cert = new X509Certificate2(certBytes, certificatePassword);
var clientAssertionCertificate = new ClientAssertionCertificate(clientId, cert);

var authenticationResult = 
    await authenticationContext.AcquireTokenAsync(resourceToAuthenticate, clientAssertionCertificate);

Answer 2

Just building on the last answer. You should follow the information in this article: https://graph.microsoft.io/en-us/docs/authorization/app_only , which talks you through using the OAuth2.0 client_credential flow to acquire an application access token (with no user context), including how to get an administrator in your customer's tenants to authorize access for your multi-tenant application. The answer above uses the auth client library (ADAL) to show you how to acquire a token, but this can also be done using HTTP requests.

NOTE: You shouldn't need to worry about service principals etc with the documented link above - that's all mechanics that happens under the covers through the consent/authorization flow.

Hope this helps,