用户同意使用 Microsoft Graph API 读取 Outlook/Teams/Sharepoint

Question

I have to read User emails (particular subfolder), One Drive, Team Channels and Sharepoint after some regular intervals at the background using Microsoft Graph API but not without having the user consent which should be taken only once when they logged in to the web based application first time and not afterwards. I am not sure where to start from and how this can be achieved? Should the token be stored forever in some database securely OR Is it the AAD?

Would really appreciate any pointers/APIs/Libraries/concepts or links which can help in moving towards this direction.

Answer 1

If you want to get the token without user, client credentials flow can be used. The flow permits a web service (confidential client) to use its own credentials, instead of impersonating a user, to authenticate when calling another web service.

In the client credentials flow, permissions are granted directly to the application itself by an administrator. So it is necessary to use the application permissions . You could call Microsoft Graph API with the access token.

For example, call this API to get message:

You need to add one of the application permissions to API permission(navigate to Azure Active Directory-> your application), and click grant for your tenant .