►
From YouTube: Authentication with Graph SDKs
Description
Authentication with Graph SDKs
To call into Microsoft Graph, your code must acquire an access token from the Microsoft identity platform. To get an access token, your app must be registered and authorized with the Microsoft identity platform.
In this episode, Darrel Miller joins Christos to show us all how to make authorized requests with the Microsoft Graph SDK within our .NET applications.
[01:30] - What is Microsoft Graph?
[01:56] - How does security work with the Graph SDK?
[07:12] - Authenticating a Microsoft Graph client (Demo)
[13:50] - Authenticating a Microsoft Graph in ASP.NET (Demo)
[21:30] - What are the different flavors of Graph NuGet packages?
Microsoft Graph
https://docs.microsoft.com/graph/overview?WT.mc_id=dotnet-00000-cephilli
Microsoft Graph Dev Center
https://developer.microsoft.com/en-us/graph?WT.mc_id=dotnet-00000-cephilli
Microsoft Graph Explorer
https://developer.microsoft.com/en-us/graph/graph-explorer?WT.mc_id=dotnet-00000-cephilli
Microsoft Graph on GitHub
https://github.com/microsoftgraph
#dotnet #security #MicrosoftGraph
A
A
B
A
B
Yeah,
absolutely
so
I
mean
the
microsoft
graph,
we're
a
very
large
http
api
for
accessing
all
of
your
data
in
the
microsoft
365
cloud
and
in
order
to
make
it
easier
to
access
that
api,
we
ship
a
sdk
er
for
net
space.
It's
a
nougat
package.
Actually
it's
two
nuget
packages
and
we'll
talk
about
a
little
bit
more
about
that
in
in
later
on.
A
B
B
Yeah
absolutely
I
mean
when
folks,
especially
folks,
coming
over
from
the
azure
side.
They
always
run
into
this
wait.
What
is
this
whole
consent
and
permissions
things?
I'm
I'm
not
used
to
this
right
and
the
difference
with
graph
is
you're,
building
an
app
that
then
other
people
are
going
to
run
to
be
able
to
access
their
data.
B
So
when
you
run
that
application
that
application
is
going
to
pop
up
a
dialog
that
says,
hey
you
running
this
app,
do
you
really
want
it
to
access
that
data
and
the
app
actually
has
to
make
a
declaration
and
say
I
would
like
to
access
this
particular
type
of
data?
I
want
to
access
your
emails.
I
want
to
access
your
files,
your
calendar,
so
that
the
user
can
consent
and
that
that
consent
is
then
recorded.
B
So
that
adds
an
extra
little
bit
of
complication
that
folks
are
probably
not
used
to
in
many
apis
that
they've
been
working
with,
and
then
it
goes
a
little
bit
further
because
there's
two
types
of
permissions
there's
what
we
call
delegated
access
and
app
only
access,
and
so
these
two
types
of
permissions
generally
there's
both
of
them
available.
Although
some
that
we're
still
working
on
teams,
saying
hey,
you
have
to
add
app,
only
access
so
delegated
is
where
your
application
accesses
data.
A
Right
so
for
for
applications
that
we
expect
to
have
users
like
a
web
app
or
a
client
app
like
a
mobile
app,
then
you
can
expect
the
user
to
authenticate
and
provide,
though,
that
consent
right.
So
I
want
to
access
my
directory
or
my
onedrive
data
or
my
emails.
Then
that's
where
delegate
authentication
comes
in
or
delegate
consent
and
then
for
app,
only
there's
a
daemon
app
running
somewhere
that
needs
to
go
and
pull
some
data
from
graph.
B
Is
available,
there
can
actually
be
hybrid
scenarios
where
you
have
a
user
signs
into
an
app
they're
working
on
some
data,
but
in
the
back
end
the
app
is
using
a
sharepoint
list
to
be
able
to
store
some
data
and
it
wants
all
users
who
log
in
to
be
able
to
access
that
same
sharepoint.
So
it
might
actually
use
app
only
to
access
that
shared
storage.
A
B
Yeah
and
we
don't
get
the
access
tokens
we
delegate
to
msl
using
this
auth
provider
thing.
If
you
look
at
a
bunch
of
samples
out
there,
they'll
use
can
basically
like
a
delegate
which
is
called
delegated
auth
provider.
That
kind
of
is
it
throws
it
back
in
the
user
and
says:
go
go!
Do
all
the
work
yourself
right,
which
is
why
we
bought
this
built,
this
auth
provider
library
for
all
the
different
scenarios.
B
They
are
a
an
adapter
between
the
credentials
that
you're
coming
with
and
the
msl
library
under
the
covers,
and
so
we
will
be
moving
to
a
model
that
has
that
uses
token
credentials
and
if
you
actually,
if
you
pre,
pull
a
preview
of
our
core
library
at
the
moment,
you'll
be
able
to
use
that
and
that
the
azure
identity
libraries
have
these
neat
things
where
they
have.
This
thing
called
a
chained
token
credential
yeah,
so.
A
B
You
can
set
something
up
that
says:
well,
if
I'm
in
a
dev
environment,
go
get
the
token
from
here
and
if
you're
in
a
production
environment
go
get,
it
from
say,
managed,
identity,
and
so
that's
really
cool.
It
also
comes
with
another
thing:
called
default:
azure
credential,
which
does
work
really
well
in
the
azure
world.
It
doesn't
work
quite
so
well
in
the
graph
world
because
of
that
whole
consent,
thing
right,
so
change
token
credentials,
awesome
use
it.
B
B
Okay,
so
always
start
with
the
absolute
simplest
thing
possible.
This
is
a
net
core
console
app.
I
created
it,
basically
just
doing
dot
net
new
console
and
there
we
go.
I
had
my
hello
world
and
I
added
a
few
lines
of
code
and
we'll
just
walk
through
this,
just
to
show
the
the
steps
that
are
involved
and
as
I
mentioned,
we
use
msl.
So
we
are
here,
I'm
going
to
do
a
device
code
auth
because
it's
in
the
console
app.
So
that's
the
simplest
thing
to
do
and
get
working
cross-platform.
B
Yes,
absolutely
so
we
are
going
to
use
public
application
builder
we're
going
to
go,
create
I've
provisioned
myself,
a
a
client
id
which
I
did
using
powershell
script
from
our
microsoft
graph,
sdks,
yes,
and
so
it's
nice
and
repeatable,
because
I
always
forget
to
click
on
something
when
going
through
the
app
registration
portal.
So
this
creates
me
a
public
client
application
and
then
I'm
going
to
create,
as
I
mentioned,
a
device
code
provider,
there
are
other
providers
available
for
other
scenarios
right
and
I
pass
in
that
public
client
application
and
also
providing
initial
scopes.
B
So
I
know
that
this
particular
application
is
only
going
to
go
and
do
read
a
user.
So
I'm
going
to
put
user.
I
should
probably
have
just
done
user.read,
but
I
put
user.read.all
which
allows
me
to
access
to
all
users
and
I
can
set
up
the
basic
set
of
scopes
here
that
I
want
this
app
to
consent
to
when
you
first
run
it
right
and
that
builds
me
an
authentication
provider
and
I
pass
it
into
graph
service
client
and
there
you
go.
B
I
have
a
graph
client
and
then
I
can
go
and
use
the
graph
client
in
order
to
make
the
request
and
the
graph
client
again
works
a
little
bit
differently
than
a
lot
of
the
azure
services.
When
the
azure
services
each
one
gets
its
own
client,
whereas
there's
one
graph
client
for
all
of
graph
and
there's
a
hierarchy.
B
So
as
if
I
can
use
the
dotting
mechanism
here
I
get
intellisense.
Oh,
I
can
send
mail
via
here
I
can
go
to
teams
related
things,
there's
all
kinds
of
different.
I
can
get
my
calendars
and
but
for
this
example,
we're
just
going
to
go.
Get
me,
which
is
my
profile,
I'm
going
to
go,
get
a
request
and
then
from
the
request
I
can.
I
could
do
other
provide
other
options
here,
yeah
and
then
I
just
oh,
I'm
going
to
get
it
update
it
in
this
case.
B
B
It's
configuration
like
I
haven't,
run
this
thing
a
hundred
times
before
today,
but
okay,
while
it's
running,
I
will
continue
my
story
about
auth
providers
and
why
they're
useful,
because
we
don't
want
you
to
just
grab
a
token
and
hold
on
to
it,
because
msl
does
all
kinds
of
wonderful
stuff
under
the
covers
like
hey.
If
you,
if
that
token
is
expired,
it
uses
a
refresh
token
to
go
off
and
get
another
one.
Yes,.
A
B
A
A
B
So
the
idea
here
is
I've
been
able
to
acquire
a
token
this
provider.
The
nice
thing
is
like
when
I'm
making
the
call
to
graph.
I
just
don't
have
to
think
about
that
token
itself.
It
just
magically
goes
and
gets
it
for
me.
It
magically
goes
and
refreshes
it
as
needed
and,
as
I
mentioned,
we're
going
to
be
adding
in
a
new
capability.
That's
coming
into
aad
called
continuous
access
evaluation
and
with
that
mechanism,
what
happens
is
normally
tokens
are
given
an
hour
long
lifetime
yep.
B
But
what
happens
if
somebody
goes
and
changes
the
password
or
their
account
is
closed
that
token,
still
good
for
an
hour
with
continuous
access
to
valuation,
we
can
shut
that
token
down
immediately
and
the
nice
side
effect
is.
We
can
make
those
tokens
last
longer,
so
those
tokens
will
be
good.
I
think
up
for,
like
24
hours,
those
tokens,
so
they
won't
need
to
be
refreshed
anywhere
near
as
often
as
before.
So.
B
Yeah,
absolutely
so
that
that
that
was
the
easy
example
right,
getting
a
console,
app,
no
problem
now
what
about
actually
building
a
web
app
right?
Yes,
how
about
web
apps
web
apps
right
now,
there's
a
few
parts
of
this
one.
First
of
all,
I
did
the
same
thing.
I
did
dot
net
new
template,
okay
and
spill
use
the
web
app,
but
this
time
now
you
do
auth
in
order
to
say
please
will
you
pull
me
in
some
of
the
auth
stuff?
B
Yes,
and
that
brings
us
in
the
all
of
the
sign
in
mechanism
in
order
to
be
able
to
sign
into
a
web
app.
But
then
what
happens
if
I
actually
want
to
call
a
backend
api,
there's
a
bunch
of
extra
steps
that
we
need
to
do
so,
I'm
just
going
to
flip
over
to
my
other
browser
here
and
we'll
start
with
the
app
settings,
because
there
was
some
new
items
that
I
need
to
add
into
the
app
settings.
First
of
all,
I
need
to
put
it
in
tenant
a
tenant
id.
B
I
don't
actually
need
the
tenant
id,
because
I
set
this
up
as
a
multi-tenant
app.
I
can
just
put
common
in
here
so
we're
all
good,
because
this
app
is
now
going
to
be
taking
the
incoming
token
and
converting
it
for
token
to
call
graph.
It
needs
its
own
client
secret
to
be
able
to
authenticate
itself
to
be
able
to
get
a
token.
So
I'm
gonna
go
and
delete
that
secret
right
after
this
this
session.
So
try
not
you,
don't
need
to
try
and
remember
it.
A
B
Msal
to
work
with
asp.net
to
do
this
magic
of
taking
this
incoming
token
and
converting
it
for
a
token
for
a
backend
api.
It
also
has
another
library
for
identity.web.ui
and
just
to
make
life
super
easy
identity.web.microsoft
graph,
and
this
is
the
latest
version
as
of
friday.
It
was
a
new
version
of
this
release,
so
it's
got
some
new
fancy
features
in
microsoft.identity.web
living
on
the
edge.
B
Absolutely
I
I
need
this
video
to
last
for
as
long
as
possible.
So
if
we
go
head
over
into
the
startup
because
that's
where
all
the
magic
happens
yes,
you'll
see,
there's
more
red
than
there
is
green,
which
is
good
because
it
means
we
got
to
delete
a
whole
bunch
of
code,
oh
yeah.
So
now,
if
I
can
get
that
scroll
bar
to
appear
there,
we
go
we've
added
services.add
authentication,
open
id
connect,
defaults.
B
B
Now
this
is
the
new
overload,
there's
a
couple
of
overloads
that
were
there
in
the
earlier
version
that
allowed
you
to
just
provide
a
base
url
and
provide
the
scopes.
This
one
actually
accepts
a
funk
passes
in
an
auth
provider,
which
is
the
magical
one
that
that
identity
web
creates
for
me,
which
I
then
pass
into
my
graph
service
client,
and
if
you
want
to
do
any
kind
of
customization
that
you
want
in
here,
you
can
do
this
right
here.
B
However,
you
want
to
set
up
your
graph
service,
client
right
and,
and
then
you
just
return
that
back
out
and
we
need
to
pass
in
the
the
initial
scopes
into
the
auth
provider
also,
and
so
that's
what
how
that
now
works
with
that
new
mechanism
and
the
last
change
here
is
adding
this
add
microsoft,
identity,
ui
to
make
the
sign
in
and
sign
out
work,
and
that's
mostly
it.
There
was
a
minor
little
change
that
had
to
happen
in
the
login
partial
just
to
change
the
areas
for
the
sign
in
and
sign
out.
B
A
B
A
So
it's
a
razer
pages
but
because
microsoft
end.web
is
now
available
to
all
3.1
and
upwards
asp.net
core
projects
you
get
grpc
you
get
blazer,
blazer
wasn't
actually
blazer
wasn't,
doesn't
work
with
microsoft.web,
let's,
let's
practice
the
site,
but
anything
that
has
ac
or
31
and
above
it
can
benefit
from
this
pattern.
So
you
know
if
you
are
working
with
graph,
it's
a
one-liner
to
add
it
to
your
project,
one
negative
package
and
then,
from
that
point
onwards
you
can
inject
it
and
call
it
as
you
see
fit.
A
B
A
B
A
B
B
A
B
A
B
I
apologize
to
all
the.net
devs.
This
has
nothing
to
do
with
core.
This
is
a.net
standard
library,
so
it
works
in
full
framework
or
it
works
in
desktop,
but
we
have
our
core
library
and
then
we
have
our
service
library.
Think
of
it.
This
way
the
service
library's
a
lot
of
code
generated
stuff
that
has
all
of
our
model
classes.
So
if
you
want
nice,
rich
intellisense
just
go
get
microsoft.graph.
B
If
you
just
want
our
http
library,
with
our
middleware
for
handling
retries
and
doing
auth,
you
can
do
microsoft,
graph.core
right
and
the
microsoft
graph.org
library
is
the
one
that
has
all
of
our
auth
providers
and
last
but
not
least,
as
you
mentioned,
yes,
those
libraries
are
v1.
We
also
have
microsoft
graph.beta,
which
is
the
service
library
that
has
all
the
new
stuff
that
is
coming,
and
it's
important
to
realize
with
the
graph.
The
way
we
do
beta
and
v1
is
a
little
funny
beta
is
it's
everything.
B
A
Awesome
so
we'll
we'll
include
the
links
below
thanks
daryl
for
coming
and
enlightening
us
on
graph
and
how
people
can
build
rich
applications
for
their
users,
because
all
that
information
is
just
sitting
there
for
you
to
actually
pull
it
if
you're
building
line
of
business
apps
with
azure
id
and
graph
and
we'll
have
a
follow-up
episode
where
we
go
into
a
little
bit
of
how
you
can
customize
things
with
graph
next
time.
Thank
you
very.