Microsoft Graph Api令牌无效或未授权？

Question

I'm trying to read the user's data from Azure Active Directory via Microsofts' Graph API. Using the Graph Explorer I'm able to get all users but using a stand alone application I end up with an "unauthorized" response after receiving a token. I'm clearly missing some steps but it isn't obvious to me what steps that would be. Any insight would be appreciated

The code below is based off a MSFT sample:

// config values
// authority = "https://login.microsoftonline.com/{ TENANT ID }/oauth2/" 
// resource uri = "https:// APP NAME .azurewebsites.net";
// graph uri = https://graph.windows.net/TENANT ID/ also tried https://graph.windows.net/v1.0/


// short form
public async void GetUsers( ADConfiguration config )   
{
     _authContext = new AuthenticationContext(config.GetAuthority());
     _clientCredential = new ClientCredential(config.ClientId, config.ClientSecret);

     AuthenticationResult result = null;

     // obtain the token, this part is still successful
     result = await _authContext.AcquireTokenAsync(config.ResourceUri, _clientCredential );

    _httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", result.AccessToken);


     string address = config.GetGraphiUri() + "users?api-version=1.6";

     // this response is always unauthorized
     HttpResponseMessage response = await _httpClient.GetAsync(address);

}

Answer 1

In addition to answer your new problem . From you code , you are acquiring token using client credential flow . In the client credentials flow, permissions are granted directly to the application itself.

Since you are using Azure AD Graph API , you need to add application permission :

1. In the Azure portal, choose your application, click on Settings
2. In the Settings menu, choose the Required permissions section ,select Windows Azure Active Directory (Azure ad graph api) , add related application permissions your app requires .
3. Inside your app's blade, hit Grant Permissions to do admin consent with your admin's credential .

Answer 2

Your config values seem off:

Authority should be: https://login.microsoftonline.com/{TENANT ID} .

It seems to me that you are trying to use Azure AD Graph API, not Microsoft Graph API.

In that case:

Resource URI should be: https://graph.windows.net/ . (MS Graph API is https://graph.microsoft.com/ )