Microsoft 365 Community Community Demos, 14 Jun 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Introduction to Microsoft Graph Postman collection

Description

In this 17-minute developer focused demo, Sébastien Levert starts on the ground floor with Postman fundamentals – how Postman – the tool (API platform for building and using APIs), is used with Microsoft Graph – the APIs source. Postman simplifies each step of the API lifecycle and streamlines collaboration so that you can create better APIs faster. Use the 8 step Microsoft Graph Postman collection to get started with Microsoft Graph APIs in minutes and get simplified authentication, pre-defined endpoints, and environment variables. This PnP Community demo is taken from the weekly Microsoft 365 Platform Community call recorded on June 14, 2022.

Demo Presenter
• Sébastien Levert (Microsoft) | @sebastienlevert

Supporting materials
•Documentation - Use Postman with the Microsoft Graph API | aka.ms/graph/postman

Learn more
• Microsoft 365 Unified Sample gallery - https://aka.ms/m365/samples
• Microsoft 365 Platform Community in YouTube - https://aka.ms/m365/videos
• Microsoft 365 Platform Community - http://aka.ms/m365/community

A

So today I want to do a quick introduction to our postman collection for microsoft graph, but um this will be a series of of different of different sessions. We don't know exactly yet how much of them, but at least two or three sessions around. How can you get great tooling, to play with postman in microsoft graph? The reason why is we really believe that there is a strong connection between postman as a tool and microsoft graph as an api that can work together in this session?

A

I want to go through the fundamentals of what postman is. How does it play together with graph? How can you get some sort of data through postman connecting to microsoft graph, but the next couple of sessions we're gonna, go and really do some advanced scenario, doing chaining of different requests. We're gonna do uh how does this uh integrate with our own graphics blur? What are the scenarios of what to use when and all that, but for today, it's really around the introduction to postman for microsoft. Graph.

A

Look at this beautiful animation, that's great! So, first, what is postman if you've never used postman? It's absolutely! Okay! Postman has been there for a long time is, is usually one of the tool that is basically open at all time, for anybody that are heavily using apis or building apis postman is a full api platform.

A

It helps you test, build validate work as a team, but one of the part that you want to focus on today is really around using an api, so it really enables you to use apis in a secured way in a very convenient way.

A

It simplifies each step of the api and it enables you to work collaboratively around the api. So it's a full platform. There is a free version that we're going to use today, which is absolutely sufficient to do what we want to do with microsoft graph.

A

But if you're looking into more the enterprise capabilities, you can definitely look into what postman can offer we're going to first start with a small demo around the postman fundamentals, and here's me just to kind of get you used to the ui used to the capabilities that postman really offers and from there we're going to move on to more graph related topics. So let me start, let me go to here so first, this is, and I'm just going to close these things. So it's not too confusing when you land into postman.

A

You have a graphic explorer like experience, or maybe we can say that the graph explorer has a postman like experience. It's a chicken or the egg situation. Here, I'm gonna, let you figure out which one came first, but in this case I already added two different co.

A

What we call collections to my workspace, the first one, is the microsoft graph we're going to come back to this one a little bit later, but the second one is called the postman, echo think about the echo service from postman as a way to test the capabilities of what postman really offers. And let's start with the first thing, I think that's one of the most useful, the most even used scenario, which is around getting content from an api, doing a simple get to an api and get the content here.

A

So, for example, if I expand the postman echo that I have here so when you create a new postman account, you automatically get the postman echo in there, so don't delete it. It's super useful to go back to the basics every single time. So, for example, if I do a request method here, I can just click here and let's look at what we have here. First, we have the resource that we're looking for.

A

In that case, it's a postman, echo dot com, slash get with a couple of parameters that are in there and I have a big send button that send button will do the the action. So it's going to use the http verb that we have here we'll send that to this end point and we will get a response that will show up right here.

A

So what is great with this is now we have the ability not only to do a request, but also to ex to basically expose the entire response back to you when you're building an application that calls into an api having. This is a great way for you to understand what you have available so, for example, when you're looking into an odata api, when you're going to do your different, select or different filters, or even different top and limit capabilities or even count, you will see exactly what you will be getting back from it.

A

So that's a great way to understand the shape of the data and understand what you can do with that data. So when you expect a response back from that api, you know exactly how the data is shaped, though we're not just doing gets. We can do all sorts of different capabilities like, for example, I can do just a post, so I can basically send raw capabilities here um to this one here and when I hit send it automatically brings it back. So basically that api is really an echo api right.

A

I send something to the api and the api sends it back to me just to make sure that I'm not crazy that I sent the right thing that I'm getting the right thing. It's a great way to explore the features of postman.

A

Obviously, the one you want to use to build capabilities in your app or you're, going to it's going to feel a little bit lonely in your app.

A

That being said, it really helps you to understand how you can control the different capabilities of postman, because when we get into graph you're going to see that there are a lot of capabilities that we're using in graph- and I really believe that going back to the basics with a postman, echo collection is a great step for you, so there will be a couple of things you can do with here and I'll.

A

Let you explore this, I I don't want to go too much into the deeds here, but I think what is important is always use that collection to go back to the basics. If you want to test something, if you want to understand how to use a buddy, a json object to send in your um to your api whatsoever, you can definitely do that now. Let's talk a little bit about graph.

A

If you go back here, we have built an entire postman collection for microsoft graph and it literally helps you get started with graph apis in minutes to get simplified off predefined, endpoints and environment variables.

A

So when you use the link that you see here, aka dot ms slash graph, slash postman when you you get to that link, you will be able to follow a six or seven step process to get your environment set up with postmen connected to your microsoft, 365 environment. We highly recommend that you start with the microsoft 365 developer program, so you can really play around and have the full capabilities can go on.

A

Do some admin consents on these apis, create your own azure, 80 application, and all of that- and once this is done, you will be able to fork the microsoft graph collection which will give you the following.

A

So let me go here so first, we're gonna use this guide here, where we have actually an eight step guide from forking the microsoft graph postman collection. You go there, you will be able to create a fork and bring the the updated or the latest version of the graph collection inside your own environment, which is great because you're going to get notification when we change the the original collection you're going to get notifications that this has changed so you're going to be able to bring the changes back to you, it's great. Why?

A

Because, if we add new endpoints to graph- and we add them to our postman collection, now you're going to get access to them. The second thing you will want to do is to download potentially the postman agent, especially if you're using the web browser I'm a big fan of web browser. I prefer web browser to having an app installed on my machine, so I I am using the postman agent on my machine. You don't have to if you're, using the the rich client of postman, which is exactly the same experience just wrapped inside an application.

A

The third step you will want to do is to create an azure 80 application. Let me zoom in a little bit an azure 80 application, and why do you want to do that well to be able to control the permissions that you will have access to, so you will be able to add permissions as you go for every new api, so you will know exactly what are the sets of permissions that your app might be using?

A

That's what I highly recommend any developers when you're using an application and you're using postman, make sure that postman in your application might even be using the same azure ad app. So that way, when you test stuff in postman, you have the same set of permissions that you have in your app. So that way, you don't get data that you would not get actually in using the sdks or using raw http calls go through that procedure.

A

Something really interesting that we enable with the graph collection on postman, is support for application permissions. You cannot do application permissions today on graph explorer for a multitude of reasons, mainly security, specific reasons. So how can you test app permissions?

A

Well, postman will be your best friend so you're going to set up your azure 80 application, which support and certificate and secrets to support the full app permission cycle. Then afterwards, you will configure the authentication inside postman to make sure that you can get tokens either delegated or app permissions on the endpoints you're gonna be able to start and get a first delegated token you're gonna run your first delegated request, you're going to get a first app access token and the same thing for your first app request.

A

So the link, I would assume somebody posted in the chat, if not I'm, going to post it right after this is kind of your home base to get started with graph and postman. But what I want to do today, I want to show you the experience once you're in postman of these things. So, first of all let me go to my workspace here and let me close these two tabs that I have open earlier that we're calling into the postman echo service and let me expand on the graph here.

A

So first you're going to find two different folders, one that is delegated and one that is application permissions. So basically, every requests that live in delegated will all be using a single token. So all you won't have to re-authenticate every time you just need to use to authenticate with your delegated, and all of these requests that are here will automatically get access to the delegated token same thing, with the application. You're gonna be able to do the exact same thing.

A

So, let's start on how you get a token and how you can make a call from here. So first you want to go to your delegated tab and you click here and you're. Gonna find! Oh there you go. You have a bunch of stuff that was already done. Using the guide that I uh showed earlier, you will be able to go. You go at the bottom, you're gonna be able to say get a new access token. Now, I'm gonna select my account and now it just completed.

A

So it's really really really well integrated between our oauth service and in this case uh postman, then afterwards, you're going to click on use. A token because that's the token you want to use, and now let's say you want to go to the users and you want to get my profile so now you see https graph.microsoft.comme,.

A

We will automatically, if that's one of the beauty of using the collection, we will automatically add to the headers the right access token and make sure that you're always authenticated. So that way you won't have to copy paste that token, over and over and over again. In that case, I have this one here. I click send and automatically I get my user here. I can also go here and change it. Hey I want to.

A

I don't wanna have the v1, I want the beta endpoint and I can just click on send and I'm gonna get the exact same thing, but in a beta context. So that's a great first experience right.

A

We were able to get data from graph without copy pasting access tokens from anywhere we're using the authentication mechanism of postman to achieve a simple task, but that could take a little bit of time to get to so quite happy that this is done for us by leveraging that collection that automatically deals with all of this and in future sessions, we're gonna go how we're gonna go see how we can leverage that automation of injecting these tokens to take advantage of when you're building other requests.

A

So let's do the same thing I'm going to hit, don't save and let's do the same thing with application. So the application here is exactly the same thing. The only difference is that we're using a client id and a client secret, rather than a delegated token. That requires me to log in so now. I'm just gonna click get access. Token. It's used in my client id my client secret. It got an app only token, but I can now use to see maybe the list of all users, and now I can go here.

A

I can get send and get access to all of my users that are in tenant. I can do this on any type of of at point that lives into graph. That supports a permission. Last thing I want to show is: how did I get all of this thing to work? Well, in my app that I'm using, I have an app that is using that we're using an actually the app sorry that we're using to authenticate in there.

A

We already have a list of api permissions, and here it's really up to you to decide to decide what are the scopes that you want to support. So, for example, we see that we have user.3.all sites that you.all files the tree, but let's say we don't have anything related to emails or anything related to mail or to teams.

A

Well, in that case, I'm going to have to go through blue party, but like we would receive back an a 403, a forbidden, then how do we get a new token? You go into your app. You add your new permission. You do a grant admin for that permission, then you can go back to getting a token through postman and re-submit that request and you would be good to go.

A

So that's what I wanted to show for today, starting with the basics, the foundation of how to use microsoft, graph and postman, and we're going to be back next week with my colleague rabb on expanding on these scenarios.

A

B

Back to you, thank you so much sub great to hear the information about the postman collection. I always appreciate your demos and all the uh wonderful walkthroughs that you do share out there.