使用图形 API 从 Azure AD 获取用户配置文件

Question

I want to develop a timer job (C#), which will run at background without any logged in user, through which i need to fetch user profile (profile image and job title) from Azure AD using a graph api. I want to achieve this using delegated permissions (User.ReadBasic.All) as i'm not allowed to use application level permissions for User.Read.All. So is there any way i can achieve this.

Answer 1

Yes, but the user will have to sign in to your app at least once to initiate the process.

The way you can do this:

1. User signs in to your app (this can be a separate Web app for example)
2. You store the refresh token received in a secure manner (per user, each user has their own token)
3. Your background process can take this refresh token, and exchange it for an access token + a new refresh token
4. Store the new refresh token in the same secure storage
5. Use the access token to do what you need to do

This process will work in the background for as long as the refresh tokens work. But they can and do expire. You will need to be prepared for this as to make it work again for that user, they will have to repeat step 1 again.