Azure Graph API : Error 403 Forbidden with Azure AD B2C

Question

I have an Azure AD B2C. Since Azure Active Directory has been migrated to new portal, I have a problem to read and write tenant users data with the Azure Graph API. Before, I had an application which was created from the old portal and which doesn't work now.

So, I created a new application from the new portal, as following :

• Open "Azure Active Directory" tab
• Open "App registrations"
• Click "New application registration"

• "Properties" tab with :

  • Name : GraphApi
  • App ID URI : https://myTenant.onmicrosoft.com/graphapi
  • Home page URL : https://graph.windows.net/winbizdev.onmicrosoft.com

• "Reply URLs" tab with :

  • https:// graph.windows.net/winbizdev.onmicrosoft.com

• "Required permissions" tab with :

  • Windows Azure Active Directory -> Check 3 elements which don't require admin

• "Keys" tab with :

  • CLIENT_SECRET which never expires

Here is now my C# code to access user data from Azure Graph API :

      _authContext = new AuthenticationContext("https://login.microsoftonline.com/myTenant.onmicrosoft.com");
      _credential = new ClientCredential("<Application Client Guid>", "<Client secret which I created in "Keys" tab");
      var result = await _authContext.AcquireTokenAsync("https://graph.windows.net/", _credential);          
      var http = new HttpClient();
      var graphUrl = "https://graph.windows.net/myTenant.onmicrosoft.com/users/<My User Guid>?api-version=1.6";    
      var request = new HttpRequestMessage(new HttpMethod("GET"), graphUrl);
      request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", result.AccessToken);      
      var response = await http.SendAsync(request);
      return response;

And I always obtain a 403 error Forbidden. The version of the assembly "Microsoft.IdentityModel.Clients.ActiveDirectory" is 3.13.8.99.

So, what is wrong in my configuration? What I have to do to read and write user tenant users data again with Azure Graph API?

Thanks for your help!

Alex

Answer 1

You are acquiring acess token using client credential flow . That means you need add related Application Permissions in Required permissions blade .

All application permissions of azure ad graph api need admin consent . Please click Grant Permissions button(login with admin's account) after adding application permissions .