Skip to content

Commit 3d62174

Browse files
genlingenlin
authored
Merge pull request #8014 from genlin/main19
call-graph-api-using-managed-dentities
2 parents 3bbeb27 + cccd089 commit 3d62174

2 files changed

Lines changed: 267 additions & 0 deletions

File tree

‎support/entra/entra-id/toc.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -247,6 +247,8 @@
247247
href: app-integration/troubleshoot-authorization-requestdenied-graph-api.md
248248
- name: 404 error when managing objects
249249
href: app-integration/404-not-found-error-manage-objects-microsoft-graph.md
250+
- name: Use managed identities to call Graph APIs in VB.Net and C#
251+
href: users-groups-entra-apis/call-graph-api-using-managed-dentities.md
250252
- name: Microsoft Entra User Provisioning and Synchronization
251253
items:
252254
- name: User Sign-in or password Problems

‎support/entra/entra-id/users-groups-entra-apis/call-graph-api-using-managed-dentities.md‎

Lines changed: 265 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,265 @@
1+
---
2+
title: Use managed identities to call Microsoft Graph APIs in VB.Net and C#
3+
description: Guides to use Managed Identities to call Microsoft Graph APIs in VB.Net and C#.
4+
ms.author: raheld
5+
ms.date: 01/09/2025
6+
ms.service: entra-id
7+
ms.custom: sap:Microsoft Graph Users, Groups, and Entra APIs
8+
---
9+
10+
# Use managed identities to call Microsoft Graph APIs in VB.Net and C#
11+
12+
This article explains how to use managed identities to obtain access tokens for calling Microsoft Graph APIs in both VB.Net and C#.
13+
14+
## Configure permissions for managed identities
15+
16+
All managed identities (User Assigned or System Assigned) will have a service principal that appears in the Enterprise Apps blade. To get permissions for Microsoft Graph on those identities, you must make an OAuth Permission Grant. To do this, run the following PowerShell script:
17+
18+
```powershell
19+
# Your tenant id (in Azure Portal, under Azure Active Directory -> Overview )
20+
$TenantID = "{your tenant id}"
21+
22+
# Name of the manage identity
23+
$DisplayNameOfApp = "{your managed identity name}"
24+
25+
# Check the Microsoft Graph documentation for the permission you need for the operation
26+
$Permissions = @("User.Read.All")
27+
28+
# Main script
29+
30+
# Microsoft Graph App ID
31+
$MSGraphAppId = "00000003-0000-0000-c000-000000000000"
32+
33+
# Uncomment the next line if you need to Install the module (You need admin on the machine)
34+
# Install-Module Microsoft.Graph
35+
Connect-MgGraph -TenantId $TenantID -scopes Application.ReadWrite.All
36+
37+
# Get the application we want to modify
38+
$sp = (Get-MgServicePrincipal -Filter "displayName eq '$DisplayNameOfApp'")
39+
40+
# If assigning MS Graph Permissions
41+
$GraphServicePrincipal = Get-MgServicePrincipal -Filter "appId eq '$MSGraphAppId'"
42+
43+
# Add permissions
44+
foreach($permission in $Permissions)
45+
{
46+
$AppRole = $GraphServicePrincipal.AppRoles | Where-Object {$_.Value -eq $permission -and $_.AllowedMemberTypes -contains "Application"}
47+
48+
New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $sp.Id -PrincipalId $sp.Id -ResourceId $GraphServicePrincipal.Id -AppRoleId $AppRole.Id
49+
}
50+
51+
52+
<# Remove permissions - this portion of the script show how to remove those same permissions
53+
$AppRoleAssignments = Get-MgServiceAppRoleAssignedTo -ObjectId $sp.ObjectId
54+
55+
foreach($permission in $Permissions)
56+
{
57+
58+
$AppRole = $GraphServicePrincipal.AppRoles | Where-Object {$_.Value -eq $permission -and $_.AllowedMemberTypes -contains "Application"}
59+
60+
foreach($AppRoleAssignment in $AppRoleAssignments)
61+
{
62+
if($AppRole.Id -eq $AppRoleAssignment.Id) {
63+
Remove-MgServiceAppRoleAssignment -ObjectId $sp.ObjectId -AppRoleAssignmentId $AppRoleAssignment.objectid
64+
}
65+
66+
}
67+
}
68+
#>
69+
```
70+
## Get access token
71+
72+
After the permissions are configured in the service principal, make a token request from the following resource: `https://graph.microsoft.com`.
73+
74+
> [!NOTE]
75+
> After you make a token request for a resource, you'll get the same token for the next 24 hours, even if you make permissions changes. In order to get a token together with any new permissions, you must wait for the current token to expire.
76+
77+
```vbnet
78+
Dim at As AccessToken = credential.GetToken(New TokenRequestContext(New String() {"https://graph.microsoft.com"}))
79+
```
80+
81+
```csharp
82+
AccessToken at = credential.GetToken(new TokenRequestContext(new string[] { "https://graph.microsoft.com" }));
83+
```
84+
85+
## Call Graph APIs
86+
This example shows how to request an access token for a resource such as Microsoft Graph. When you use the Microsoft Graph service client in your code, you don't have to specify the resource explicitly because the Microsoft Graph service client handles that automatically. In VB.Net, you have to add the `Microsoft.Graph` NuGet package and then add the `Imports Microsoft.Graph` at the top of the code file.
87+
88+
### VB.Net
89+
```vbnet
90+
91+
92+
Sub Main()
93+
94+
Do While True
95+
Get_AccessToken_With_UserAssigned_MSI()
96+
Make_GraphRequest_withUserMSI_Token()
97+
Get_Secret_With_UserAssigned_MSI()
98+
99+
Get_AccessToken_With_SystemAssigned_MSI()
100+
Get_Secret_With_SystemAssigned_MSI()
101+
Make_GraphRequest_withSystemMSI_Token()
102+
103+
Console.WriteLine("Press Enter to try again or any other key to exit")
104+
Dim key As ConsoleKeyInfo = Console.ReadKey()
105+
106+
If Not key.Key = ConsoleKey.Enter Then
107+
Return
108+
End If
109+
Loop
110+
111+
112+
End Sub
113+
114+
Sub Get_AccessToken_With_UserAssigned_MSI()
115+
Console.WriteLine($"Getting access token with user assigned msi:")
116+
117+
Dim credential As New ManagedIdentityCredential(userAssignedClientId)
118+
119+
Dim at As AccessToken = credential.GetToken(New TokenRequestContext(New String() {"https://graph.microsoft.com"}))
120+
Dim accessToken As String = at.Token.ToString()
121+
Console.WriteLine($"Access Token = {accessToken}")
122+
123+
End Sub
124+
125+
Sub Make_GraphRequest_withUserMSI_Token()
126+
Console.WriteLine($"Making graph request with User MSI Token:")
127+
128+
Dim credential As New ManagedIdentityCredential(userAssignedClientId)
129+
130+
Dim graphClient As New GraphServiceClient(credential)
131+
132+
Dim users As IGraphServiceUsersCollectionPage
133+
Try
134+
users = graphClient.Users().Request.GetAsync().Result
135+
Console.WriteLine($"Number of users in tenant: {users.Count}{vbCrLf}")
136+
Catch ex As Exception
137+
Console.WriteLine($"Exception: {ex.Message}")
138+
End Try
139+
140+
141+
End Sub
142+
143+
Sub Get_AccessToken_With_SystemAssigned_MSI()
144+
Console.WriteLine($"Getting access token with system assigned msi:")
145+
146+
Dim credential As New ManagedIdentityCredential()
147+
Dim at As AccessToken = credential.GetToken(New TokenRequestContext(New String() {"https://graph.microsoft.com"}))
148+
149+
Dim accessToken As String = at.Token.ToString()
150+
Console.WriteLine($"Access Token = {accessToken}")
151+
End Sub
152+
153+
Sub Make_GraphRequest_withSystemMSI_Token()
154+
Console.WriteLine($"Making graph request with system MSI token:")
155+
156+
Dim credential As New ManagedIdentityCredential()
157+
158+
Dim graphClient As New GraphServiceClient(credential)
159+
160+
Dim users As IGraphServiceUsersCollectionPage
161+
Try
162+
users = graphClient.Users().Request.GetAsync().Result
163+
Console.WriteLine($"Number of users in tenant: {users.Count}{vbCrLf}")
164+
Catch ex As Exception
165+
Console.WriteLine($"Exception: {ex.Message}")
166+
End Try
167+
168+
169+
End Sub
170+
```
171+
172+
### C#
173+
174+
```csharp
175+
static void Main(string[] args)
176+
{
177+
while (true)
178+
{
179+
Console.Clear();
180+
181+
Get_AccessToken_With_UserAssigned_MSI();
182+
Get_Secret_With_UserAssigned_MSI();
183+
Make_GraphRequest_With_UserMSI_Token();
184+
185+
Get_AccessToken_With_SystemAssigned_MSI();
186+
Get_Secret_With_SystemAssigned_MSI();
187+
Make_GraphRequest_With_SystemMSI_Token();
188+
189+
Console.WriteLine("Press Enter to try again or any other key to exit");
190+
ConsoleKeyInfo key = Console.ReadKey();
191+
if (key.Key != ConsoleKey.Enter)
192+
{
193+
return;
194+
}
195+
}
196+
197+
}
198+
199+
static void Get_AccessToken_With_UserAssigned_MSI()
200+
{
201+
Console.WriteLine($"Getting access token with user assigned msi:");
202+
203+
ManagedIdentityCredential credential = new ManagedIdentityCredential(userAssignedClientId);
204+
205+
AccessToken at = credential.GetToken(new TokenRequestContext(new string[] { "https://database.windows.net" }));
206+
string accessToken = at.Token;
207+
208+
Console.WriteLine($"Access Token = {accessToken}");
209+
210+
}
211+
212+
static void Get_AccessToken_With_SystemAssigned_MSI()
213+
{
214+
Console.WriteLine($"Getting access token with system assigned msi:");
215+
216+
ManagedIdentityCredential credentail = new ManagedIdentityCredential();
217+
218+
AccessToken at = credentail.GetToken(new TokenRequestContext(new string[] { "https://database.windows.net" }));
219+
string accessToken = at.Token;
220+
221+
Console.WriteLine($"Access token = {accessToken}");
222+
223+
}
224+
225+
static void Make_GraphRequest_With_UserMSI_Token()
226+
{
227+
Console.WriteLine($"Making graph request with User MSI Token:");
228+
229+
ManagedIdentityCredential credential = new ManagedIdentityCredential(userAssignedClientId);
230+
GraphServiceClient graphClient = new GraphServiceClient(credential);
231+
232+
IGraphServiceUsersCollectionPage users;
233+
234+
try
235+
{
236+
users = graphClient.Users.Request().GetAsync().Result;
237+
Console.WriteLine($"Number of users in tenant: {users.Count}\n");
238+
} catch(Exception ex)
239+
{
240+
Console.WriteLine($"\nException: {ex.InnerException.Message}");
241+
}
242+
243+
}
244+
245+
static void Make_GraphRequest_With_SystemMSI_Token()
246+
{
247+
Console.WriteLine($"Making graph request with system MSI Token:");
248+
249+
ManagedIdentityCredential credential = new ManagedIdentityCredential();
250+
GraphServiceClient graphClient = new GraphServiceClient(credential);
251+
252+
IGraphServiceUsersCollectionPage users;
253+
254+
try
255+
{
256+
users = graphClient.Users.Request().GetAsync().Result;
257+
Console.WriteLine($"Number of users in tenant: {users.Count}\n");
258+
}
259+
catch (Exception ex)
260+
{
261+
Console.WriteLine($"\nException: {ex.InnerException.Message}");
262+
}
263+
```
264+
265+
[!INCLUDE [Azure Help Support](../../../includes/azure-help-support.md)]

0 commit comments

Comments
 (0)