►
From YouTube: From zero to hero with Microsoft Graph API – July 2021
Description
This month’s in-depth topic: From zero to hero with Microsoft Graph API. This session opens with an overview of Microsoft Graph services and Microsoft Graph Explorer tool. Presenter dives into access and permissions - source and access tokens, and REST API for CRUD operations including querying examples – filter, select, paging, batching, and throttling in Graph Explorer. Substantive review of metadata (queryable resources and their JSON structure, types, properties…), and options for automation & DevOps (app registration, OAuth, policies, deployment). Session was delivered by Microsoft Program Managers Christer Ljung and Rohit Gulati. Recorded on July 15, 2021. Live and in-chat Q&A throughout call.
Stay connected:
• Twitter https://twitter.com/microsoft365dev and @azuread
• YouTube https://aka.ms/M365DevYouTube
• Blogs https://aka.ms/m365pnp/community/blog
• Recurrent Invite https://aka.ms/IDDevCommunityCalendar
A
My
area
within
the
identity
group
is
around
external
identities,
which
is
b2c
b2b
and
the
new
and
upcoming
technology
around
decentralized
identities,
and,
of
course,
I
mean
being
in
identity.
You
use
graph
more
or
less
all
the
time.
So
that's
what
we
have
here
for
you
today,
let's
get
going-
and
this
is
the
agenda
for
today
and
we'll
start
with
an
overview
of
microsoft
graph,
what
it
is
also
an
overview
of
graph
explorer.
So
you
get
familiar
with
that.
A
At
the
end,
we
look
into
the
metadata
how
you
can
navigate
in
the
in
the
graph
here
and
I'll.
Show
you
at
the
end
what
you
can
do
with
automation
and
devops
how
you
can
make
use
of
graph
in
in
those
areas,
but
first,
what
is
microsoft,
graph,
microsoft
graph?
It
is
a
gateway
to
data
and
nowadays
also
intelligence,
around
microsoft,
365.
A
Our
cloud
service
is
a
unified
programming
model
with
a
single
endpoint
graph
microsoft
com
we've
had
a
bit
of
sort
of
a
confusion
with
the
radiograph
that
is
graph
windows
net,
but
I
think
that
as
time
has
moved
on,
people
know
that
it's
graph
microsoft
com
that
we
should
use-
and
we
are
at
on
feature
level
to
to
start
using
graph.
So
if
you
by
accident,
are
using
graph
windows
net,
you
should
be
aware
that
you
should
really
start
move
on
to
graph
microsoft
com
to
make
sure
that
that
is
what
you're
using.
A
We
also
have
connectors
and
data
connect
kind
of
a
similar
name,
but
it
works
like
with
the
connectors.
You
can
extend
and
get
your
data
or
other
data
into
the
graph,
so
it
can
be
used
via
the
the
programming
endpoint
and
with
data
connectors,
you
can
do
the
opposite.
You
can
take
data
that
is
in
the
graph
and
and
connect
it
to
other
consumers
like
azure
event,
tab,
etc.
So
you
can
so
you
can
use
the
data
that
is
in
the
graph.
A
Then
the
question
is:
what
is
the
graph
then?
Well,
you
do
have
the
core
services
like
bookings,
calendar
program
data
like
excel
onedrive,
et
cetera,
search,
onenote
outlook,
where
you
can
I
mean
in
the
old
world,
with
win32,
apis,
etc
and
the
office
apis.
You
could
manage
the
data
that
way
and
access
it,
but
in
the
cloud
world
you
can
use
graph
to
query
data
like
what's
in
onedrive.
What's
in
that
folder
do
I
have
any
messages
lately
in
my
outlook,
inbox?
A
A
You
also
have
the
ems
services,
the
enterprise
management,
suite
as
it
was
called
where
you
have
azure
id,
and
this
azure
id
is
really
one
of
the
core
things
in
in
the
graph
with
its
user
directory
objects,
groups,
etc.
That
you
can
use
to
to
to
add
data
that
you
then
can
sort
of
assign
permissions,
etc.
To
you
also
have
the
advanced
threat
analytics
and
the
threat
protection
where
you
can
get
access
to
that
type
of
data,
the
graph
it's
also
about
identity
manager
and
intune.
A
In
tune
really
should
have
the
new
name,
but
it's
still
called
in
tune
here
in
this
slide,
where
you
can
query
that,
under
the
umbrella
of
the
ems
services,
you
also
get
access
to
the
windows.
10,
the
device
services
like
device,
notifications
and
universal
print
dynamics.
365
is
also
available.
We
have
a
graph
where
you
can
query
business
central
data
out
of
the
graph
one
thing
to
to
address
here.
What
is
not
it's?
A
It's
you
probably
know
the
azure
resource
manager
and
the
way
to
access
and
provision
things
in
azure
like
web
apps,
virtual
machines,
storage,
account,
kubernetes
clusters,
etc.
That's
not
graph.
It
has
its
own
management.
Api
management
azure.com,
it's
a
little
bit
intertwined
because
we're
using
the
same
authentication
system
with
azure
id.
So
you
still
need
to
get
the
access
tokens,
etc.
A
To
do
the
things
that
you
want
to
do,
but
once
you've
got
the
token
you
if
it's
azure
research
manager,
you
fire
off
the
the
calls
to
management
azure.com
and
if
it's
the
graph,
it
goes
to
graph
microsoft,
com,
the
powershell
libraries
and
azure
cli
hides
this
a
bit,
because
if
you
have
a
commandlet
and
a
command
where
you
can
do
things,
you
can
pick
a
partial
command.
Let's
cover
both.
You
can
do
things
on
a
virtual
machine,
a
web
app
and
you
can
manipulate
entities
that
really
exist
in
the
graph.
A
A
Then
we
have
the
graph
explorer
and
that
is
you
can
think
of
it
like
it's
our
postman
tool
on
top
of
graph,
where
you
can
start
to
get
familiar,
easy,
easily,
query
it
etc
and
play
with
queries
and
test
them,
etc
and
see
how
it
works.
It's
an
online
tool
that
is
very
helpful
to
get
started
to
to
do
ad
hoc
queries,
etc
and
see
how
it
works,
see
if
you
get
the
right
data,
if,
regardless,
if
you're
doing
scripting
or
if
you're,
programming
etc,
it's
an
easy
tool
to
get
started
with.
A
Remember
that
it's
it's
just
an
application
like
any
other
that
is
using
the
graph
api.
It
could
be
something
that
you
have
written
or
someone
else
has
written.
So
in
order
to
give
permissions
to
start
accessing
this,
you
need
to
modify
you
need
to
add
the
permissions
to
the
app,
because
otherwise
I
mean
graph
explorer,
has
zero
permissions
to
begin
with,
and
once
you
start
using
it,
and
you
add
the
permissions
that
you
wanted
to
have
it's
the
same
as
if
you
sort
of
purchased
an
another
application
from
a
third
party
etcetera.
A
Do
you
want
it
to
have
the
permission
to
reset
passwords,
delete
user
objects
and
set
rights,
something
you
need
to
consider
and
grant
that
application
permissions,
and
it's
the
same
with
microsoft,
graph
explorer?
You
will
see
that
when
you
play
with
it
that
it
will
ask
for
permissions
every
now
and
then
or
very
often
to
be
honest,
but
that's
because
you
haven't
granted
it
yet.
So
you
need
to
sort
of
make
sure
that
you
give
it
the
permissions
to
complete
the
queries.
A
It's
also
got
some
other
golden
nuggets
hidden
here
and
that's
the
sample
queries
that
you
have
in
the
lower
left
corner
where
you
can
sort
of
look
at.
How
do
I
do
this?
How
do
I
do
that,
etc
and
start
to
get
a
feeling
for
how
to
use
it
if
you're
unsure?
If
you
sort
of
just
not
done
that
before
that
area
of
type
of
querying,
it
also
got
other
things
like
you
can
sort
of
what
you're
doing
you
can
get
code
snippets,
it's
adaptive.
A
The
toolkit
component
is
even
something
that
it
helps
you
as
a
web
developer,
because
if
you
want
to
have
that
look
and
feel
having
sort
of
that
little
rectangle
about
a
user
and
showing
its
presence
with
a
small
picture,
etc.
The
toolkit
component
can
help
you
to
add
that
and
it's
framework
agnostic,
meaning
that
it's
html.
If
you
add
it,
it
will
work
together
with
the
graph
data
as
long
as
you
can
access
it
and
get
it.
A
If
you
don't
know
the
url
just
search
for
microsoft
graph
explorer-
and
it
will
be
one
of
the
top
links
that
you'll
get
it
loads
like
this,
which
means
that
it
looks
like
it's
ready
to
go,
etc,
but
in
the
sign
in
button
in
upper
left,
you
see
that
current
is
just
using
sample
data
in
order
to
get
going.
You
need
to
sign
in-
and
this
is
you
need
to
know
the
tenant
you're
going
to
be
signing
into
into,
and
you
can't
do
switch
directories
etc.
A
Like
that,
because
you're
signing
into
a
common
endpoint,
this
is
just
an
oauth
application:
doing
open
id
connect
with
code
flow
using
the
common
endpoint.
So
if
you're
using
your
corporate
credential
and
trying
to
sign
in
to
to
a
tenant
it's
going
to
default
to
that
tenant.
So
therefore,
sometimes
when
you
let's
see,
I
need
to
do
the
right
account
here.
If
you
want
to
sign
into
an
account
or
tenant,
you
need
to
make
sure
you
have
an
account
in
that
tenant,
especially
for
b2c.
A
So,
let's
sign
into
my
test
tenant
here
like
this.
Yes,
yes,
as
you
can
see
now,
I'm
signed
in,
I
can
do
stuff.
Like
query
myself
get
some
data,
you
see
that
we
have
two
endpoints.
We
have
the
version
one
and
we
have
beta
endpoint
it's
it's
two
apis
in
the
backend
two
graph
apis
where
we
put
stuff
in
the
beta
endpoint
for
stuff
that
is
coming
and
you
can
use
that
you
just
need
to
use
a
different
endpoint
and
the
v1
is
sort
of
that
is
sealed.
A
It's
delivered
it's
going
to
stay
there,
be
there
forever
until
we
have
1.1
you'll,
also
notice
that
the
v1
endpoint
has
far
less
data.
It
just
gives
you
some
defaults.
The
rest
is
there,
you
need
to
ask
for
it
while
most
of
the
services,
if
I
switch
to
the
beta
endpoint,
it
basically
spews
out
the
entire
entity,
with
all
the
attributes
etc.
A
For
you
to
see
so
sometimes
it's
easier
to
work
with
the
beta
endpoint,
because
it
gives
you
all
the
details,
but
remember
if
you're
sort
of
scripting
something
or
writing
something
for
production,
make
sure
you
sort
of
use
the
v1
endpoint.
If
it's
going
to
be
in
production
or
something
like
that,
so
yeah
with
the
the
getting
started
you
can
see,
you
can
just
click
on
it
and
it
will
load
like
my
profile.
My
photo
here
is
pastel
faulty
etc.
A
My
manager,
I
don't
think
he
has
one
and
you
could
do
my
mail
and
it
will
show
you
the
mail
if
you
do
have
a
mail
enabled
account
the
code
snippets
that
I
talked
about.
If
I
flip
to
code
snippets
here,
you
can
see
that
it's
adapted
to
the
type
of
query
that
I'm
using
it's
actually
showing
graph
client
me
photo
content,
etc,
so
that
you
can
get
that
the
tool.
A
Let's
see
it's
better,
if
I
do
that
one
toolkit
component
like
this,
it
will
show
you
this
so
that
you
can
add
templates
like
this
into
your
html
pages
and
get
the
same
experience
etc.
Depending
on
what
object.
It
is
the
way
you
query
data
here
also,
is
I
mean
you
need
to
know
that
it's
like
this.
You
can
query
me,
that's
a
shortcut.
A
A
I
can
go
further
if
I
just
want
the
display
name,
I
can
put
that
one
in
the
path
like
this
to
make
the
path
longer
and
if
you
see
in
the
photo,
if
you
like
data
like
a
photo
which
is
really
an
image,
jpeg
or
something
you
see,
it
goes
further
it.
The
path
is
me
photo
and
it
has
dollar
value,
which
means
that
I
really
don't
care
about
the
json
stuff
that
describes
this.
I
just
want
the
picture
because
I
need
to
display
it
somewhere.
A
If
I
remove
the
value,
you
can
see
that
I
get
the
json
structure
instead
of
this,
so
you
can
go
all
the
way
to
say.
I
just
want
the
value
for
this,
so
that
was
that,
and
if
you
see
the
access
token
here,
you
can
see
that
permissions.
You
can
see
what
permissions
you
have.
If
a
query
fails,
you
will
see
that
you,
it
will
not
say
200.
It
will
give
you
a
reason
why
it
fails.
It
probably
means
you
need
to
scoot
over
to
the
modify
permissions
etc.
A
Look
into
what
it
wants
you
to
do
to
consent
and
press
that
you
can
also
see
that
you
can
see
your
current
access
token
to
see
what
type
of
permissions
you
have
etc.
So
you
might
sort
of
want
to
look
into
that.
We
will
do
that
a
little
bit
later
and
I
think
that
later
is
now,
but
first,
let's
describe
this
access
and
permissions.
A
So
that
means
that
any
application
we
write
or
scripting
language
that
we
use
etc,
like
graph
explorer,
needs
to
get
authenticated
and
ask
for
permission
to
use
the
graph
api.
Then
comes
the
question
I
mean
you,
don't
get
a
wild
card
ticket.
You
need
to
ask
for
the
scopes
and
permissions
and
make
sure
that
you
have
those
to
query
the
right
data.
If
you
want
to
read
the
email
messages,
you
need
to
have
the
permissions
to
read
the
email
messages,
etc.
You
just
can't
sort
of
expect
a
graph
to
fix
it.
A
A
If
I
look
at
mine,
it's
a
lot
of
gobbledygook
here
and
I
can
copy
it
and
I
can
take
it
over
to
john.ms,
which
is
a
jot
tool
to
decrypt
an
access
token
or
id
token,
and
you
will
see
that
it
has
a
lot
of
details.
I
should
make
this
a
little
larger,
a
lot
of
details
that
it's
not
really
interesting.
Here.
A
A
A
For
this
permission,
you
can't
send
emails
and
if
I
flip
over,
you
see
that
I
haven't
mail
sent
in
my
list.
I
can't
do
that.
So
if
I
really
wanted
to
do
this,
I
would
need
to
press
consent
and
me
as
an
admin
I
needed
to
have
the
right
to
press
con
center,
but
I'm
not
going
to
send
email
messages.
That
makes
makes
no
sense
in
graph
explorer
if
you
ever
ran
using
graphics
pro
to
test
and
you're
doing,
post
put
delete,
etc.
A
A
Well,
you
can
actually
look
that
up
yourself,
because
it's
not
that
complicated
that
you
might
think
of
see
like
this,
because
this
is
the
rest
api,
where
we
access
any
rest
api.
It's
just
called
graph
so
and
we
have
given
the
graph
explorer
our
app
permission
to
to
do
this,
so
it
must
be
stored
somewhere
in
the
permission
system,
and
if
we
look
at
graph
explorer
with
graph,
we
can
actually
look
it
up
and
say:
hey.
A
We
should
have
a
service
principle
called
graph
explorer.
Do
we
yep
we
do
so.
Let's
do
that.
First
part
I'll
run
the
query
to
see
if
I
do
have
a
service
principle
named
graph
explorer
and
sure
enough.
It's
just
a
registered
application
like
anyone
else
with
the
name
of
graph
explorer
official
site
and
a
lot
of
reply,
urls
to
all
the
different
versions
that
we
have
etc.
A
A
A
A
So
the
crude
operations
yep
query,
we've
done
quite
a
lot
of
that.
That's
the
easy
part
you
need
to
find
the
resource
that
you're
actually
want
to
query.
You
can
find
the
direct
id
et
cetera.
Do
that
in
a
different
ways,
navigate
to
an
attribute
within
that
entity
or
it
even
be
a
navigational
property,
and
then
you
can
sort
of
navigate
all
the
way
to
the
value.
A
You
craft
the
payload
in
such
a
way
that
only
the
attributes
that
you
want
to
update
you
send
it.
You
invoke
the
patch
method
and
you
patch
the
existing
object.
You
get
a
two
or
four
no
content
back
put
is
a
little
bit
of
a
mix
here,
because
it
completely
overrides
an
existing
data.
It
doesn't
really
care
what
was
there
before,
whatever
you
send
as
the
payload,
if
it
contains
the
minimum
set
of
attributes
that
is
needed,
it's
just
going
to
overwrite
and
whatever
was
there
before
is
gone.
Not
all
entities
allow
this.
A
You
can't
do
put
on
a
user,
for
instance,
but
you
can
do
it
on
other
things.
Delete
is
pretty
simple
if
you
have
the
path
to
the
use
to
the
object
and
you
fire
it
away
with
delete,
it
is
going
to
delete
it
and
get
a
204
back,
no
content,
my
user.
Here,
let's
go
back
to
myself
to
show
you
this,
you
see
this
is
my
user
basil
faulty?
A
He
has
an
office
location
of
that
for
whatever
reason,
but
that
is
not
correct,
because
I
believe
that
the
office
location
is
actually
torquey
in
cornwall
england.
So,
let's
flip
to
patch
and
patch
mr
faulty
here,
like
that,
I
get
a
204
back
and
if
I
revert
back
to
get
again
and
query
it
sure
enough,
I've
updated
the
attribute
to
torquey.
This
is
easy
way
to
do
it.
You
just
send
it.
If
you
have
the
permissions
use
the
read,
write,
all
etc,
or
if
it's
yourself,
you
can
update
like
this
so
querying.
A
A
I've
shown
you
the
diary
query
where
you
target
the
resource
you
find
the
id
and
you
get
it
that's
pretty
fast
if
you
want
to
have
more
attributes
that
are
not
shown
or
if
you
want
to
limit
them
like
in
the
beta
endpoint,
where
you
get
everything
use
the
select
like
this
and
let's
flip
to
beta.
So
I
get
everything
like
this
users
myself
and
with
the
beta
endpoint.
You
see,
I
get
a
lot
of
data
back,
but
I
don't
want
that.
A
So
it's
time
to
start
using
the
select
and
if
you
ever
done
anything
with
like
sql
you'll,
get
this
because
it's
just
like
sql,
you
just
specify
what
attributes
you
want
back
and
that's
what
you
get
limit
that
filter
is
compared
to
sql
is
the
where
clause
where
you
specify
well,
I'm
going
to
query
like
the
user's
object,
but
I
really
don't
know
the
unique
id
or
I
don't
care
to
find
it
out.
I
want
to
do
it
in
a
simpler
way.
I
just
want
to.
I
know
the
display
name
and
that's
that's
enough.
A
A
Like
this,
you
could
query
the
object,
do
and
I've
done
something
wrong
for
trying
to
do
two
things.
At
the
same
time
fill
I
mean
filter.
You
can
do
it
like
this
and
if
you
want
to
filter
something
that
is
not
a
simple
object
like
display
name,
if
you
have
some
an
attribute
that
is
actually
a
collection
of
things.
You
need
to
learn
the
awkward
syntax
of
filtering
on
attributes
that
are
a
collection,
and
in
this
case
other
males
is
a
collection.
A
So
you
need
to
sort
of
have
the
lambda-like
syntaxes
saying
look
into
the
collection
is
and
if
anything
matches
that
bring
it
back
to
me,
etc,
give
it
to
me,
then
you
can
you
if
you
have
lots
of
data
like
users
in
in
your
organization,
it's
just
querying
for
all
the
users,
that's
really
yeah!
It
will
give
you
a
lot
of
users,
but
it's
going
to
be
a
long
list,
and
what
are
you
going
to
do
with
it?
A
And
you
do
something
you
go
back,
you
more
or
less
do
the
top
skip,
etc.
You
could
do
top
and
you
could
say,
skip
the
first
two
like
this.
Oh,
I
don't
need
to
do
that.
Sorry,
let's
do
that
first,
like
this
and
what
it
will
give
you
is.
It
will
give
you
the
first
five
or
whatever
you
ask
for
then
it
will
give
you
an
odata
link
that
is
called
next
link
with
something
that
we
really
don't
need
to
understand
what
it
is.
A
A
And
you
need
you
need
to
post
because
it's
going
to
send
data
and
what
you're
doing
then
is
sending
a
lot
of
data
that
are
sort
of
requests
that
you
want
to.
Do
you
see
the
first
one
you
can
actually
have
the
id
could
be
whatever
you
like
it
to
be,
but
it's
you
need
to
have
it
to
correlate
on
the
responses
you
see.
The
first
is
get
on
me.
The
second
is
get
on
my
photo.
A
The
third
is,
I
I'm
going
to
list
a
few
email
messages
that
I
get.
So
if
I
post
this,
it
will
be
one
request
to
the
graph
and
when
it
comes
back
it
will
give
me
all
the
details.
You
can
see.
The
first
request
I
had
was
status
200
and
here
are
the
details,
etc,
and
so
on
that
was
the
user.
I
probably
see
the
photo
yeah,
here's,
the
jpeg
and
further
down.
A
I
will
have
the
email
message,
so
the
trick
here
is
just
to
stitch
them
together
and
fire
it
away
and
then
have
the
the
sort
of
the
pain
of
looking
through
the
response
of
all
the
details.
What
happened?
Oh,
I
got
a
200,
I
got
a
404,
I
got
a
403
etc.
What
do
I
do
in
all
these
scenarios,
where
I
get
mixed
set
of
response
status
codes
back,
but
it
can
be
pretty
efficient
because,
let's
see
if
we.
C
A
I've
got
some
powershell
here
where
I'm
going
to
import
a
set
of
users,
10
users,
not
that
much
but
it'll,
give
you
an
idea
of
of
how
you
can
use
this.
I'm
going
to
first
just
run
a
script
that
is
via
graph,
creating
the
users
from
a
csv
file,
putting
them
in
a
b2c
tenant,
and
that's
it
that's
as
exciting.
It
is.
A
This
is
just
using
graph
api
one
by
one
reading
the
one
line
sending
it
to
graph
api
reading
the
next
sending
it
to
graph
api,
and
you
see
that
10
users
took
a
little
less
than
than
five
seconds,
which
means
that
I
get
two
two
users
per
second,
which
is
not
that
fast.
Perhaps,
and
it's
going
to
take
a
lot
of
time,
and
can
I
do
this
faster?
Yes,
you
can,
and
I
just
need
to
delete
all
these
users,
so
I
can
run
this
again
deleting
them.
A
A
Oh,
I
did
ten
at
a
time.
So
what
happened?
Is
I
read
all
the
files
I
created
the
json
payload.
I
sent
it
to
to
the
graph
in
a
batch
operation
and
you
saw
what
10
users
created,
and
this
time
it
was
sort
of
0.5.6
seconds.
So,
if
you're,
in
a
situation
where
you
need
to
bulk
import
data,
perhaps
batch
is
going
to
be
faster
and
you
also
can
do
stuff
asynchronous.
A
A
First
of
all
I
mean
if
you're
looking
for
for
the
answer
to
this,
you
can
always
go
to
the
documentation,
it
will
tell
you:
what's
there
etc,
what
you
can
do,
how
it
looks,
etc,
but
you
don't
need
to
go
there.
You
can
actually
ask
a
graph
itself
for
the
metadata
and
if
you
go
to
the
graph
endpoint,
you
need
to
specify
beta
or
v1,
so
it
knows
which
metadata
to
pull
up.
You
get
the
information
you're
looking
for.
A
So
let's
go
back
to
this
one,
if
I
just
say
graph,
microsoft.com
1.0
like
this,
I'm
going
to
get
a
json
structure
back
to
say:
hey!
These
are
all
the
resources
that
you
can
ask
for,
and
perhaps
not
that
readable.
But
you
can.
You
can
do
that
in
powershell,
etc.
To
get
the
details
in
a
way
that
looks
a
bit
nicer
so
see.
If
I
can
do
that,
if
I
do
the
same
in
powershell
into
graph
objects
and
to
graph
the
dollar
f
objects.
A
Value
you
see
you
get
it
in
a
little
bit
nicer
way.
This
was
the
the
better
endpoint
that
I
asked.
So
you
see
here,
here's
a
full
list
of
all
the
resources
that
exists
and
that
you
can
query
for,
like
director
objects,
permission,
grants
etc.
So
if
you're
wondering
I
wonder,
if
that
is
available
in
in
the
graph,
you
could
look
at
the
metadata
and
see
yeah.
It
looks
like
it
is.
Then.
A
It's
the
same
endpoint,
you
just
add
dollar
metadata
this
time,
it's
not
going
to
return
json,
it's
going
to
return
xml,
and
it's
going
to
show
you
things
like
what
entities
do
I
have
what
complex
type
exists,
and
that
is
something
that
is
not
like
display
name
that
has
a
simple
string
value
where
you
have
complex
type.
It's
going
to
show
you
all
the
enumerations
with
the
values
that
you
can
set
to
to
that
enumeration
to
that
attribute.
A
A
A
A
A
I
have
a
manager,
and
it
looks
like
you
can
only
have
one
manager
here
and
it
can
be
a
directory
object,
meaning
that
I
could
have
an
application
or
a
group
as
a
manager
that
would
be
exciting
to
see,
but
it's
most
probably
going
to
be
a
user
member
of
it's
going
to
be
a
collection
of
director
objects,
because
I
could
be
a
member
of
many
things
when
you
traverse
this
and
navigate
like
director
object.
You
will
see
that
that
is
something
and
it's
based
on
entity.
A
It's
pretty
boring
entity
and
then
eventually,
you
will
see
that
you
have
a
type
that
is
this
sort
of
the
the
base
type
like
entity.
Is
that
defines
the
id
etc
and
the
id
is
a
string.
So
with
that,
when
you're
wondering
how
can
I
query
these
objects,
etc,
if
you
don't
know,
look
at
the
documentation
or
start
using
the
metadata
for
understanding,
what
can
I
do?
Is
it
possible
to
get
conditional
access
policies
out?
Yes,
there
is
okay,
what's
the
data,
how
can
I
sort
of
add
stuff
to
it?
A
A
A
And
for
that,
when
you
do
automation,
you
don't
have
a
real
user.
You
most
often
create
an
app
registration
in
the
target
tenant
and
it
needs
to
live
within
the
tenant
that
you're
about
to
sort
of
query,
and
you
do
that,
just
as
a
normal
app
registration
and
grants
granting
the
permission
that
you
are
going
to
use
direct
to
read,
write
all
might
be
tempting,
but
please
be
a
little
bit
more
sort
of
granular
about
what
the
application
is
is
intended
for.
A
So
you
don't
have
a
really
powerful
app
that
can
do
anything
with
your
objects.
Then
you
create
a
request
to
get
a
token
using
the
client
id
and
the
client
secret.
You
got
from
the
app
registration,
you
specify
scope
as
graph
microsoft,
com.default,
and
you
can
do
something
like
this
in
powershell,
where
you
just
do
a
client
credential
specifying
the
id
the
client
secret.
The
scope
ask
for
a
token,
and
then
you
can
test
it
to
see
that
it
actually
works
this.
A
Let
me
see
if
I
can
do
this
more
or
less
the
same
here
I
have
the
I
have
the
the
body
that
I'm
sending
to
get
the
access
token.
I'm
invoking
the
end
point
for
my
tenant
to
say:
hey
token
and
point:
can
you
please
give
me
an
access
token,
and
I
think
the
response
is
something
like
this.
I've
asked
for
an
access
token
and
I've
got.
A
You
will
see
that
I
don't
have
all
that
much
to
access
to
this.
I
call
my
app
graph
application
and
the
only
thing
I
can
do
is
basically
read
all
users.
That's
all
I
can
do
nothing
else.
If
I
try
to
manipulate
another
object,
it
would
say
no,
you
cannot,
but
at
least
I
can
manipulate
objects.
So
with
that,
let's
try
to
see
if
I
can
use
the
this
little
script
to
list
out
the
all
the
users
in
this
tenant.
A
A
A
In
order
for
them
to
get
activated,
I
need
to
upload
them
into
into
b2c,
and
I
do
that
via
graph.
If
you
know
nothing
on
b2c,
the
policies
need
to
contain
some
data
that
binds
them
to
the
tenant.
That
they're
going
to
be
in
so
part
of
this
sort
of
the
devops
thing
here
is
to
replace
some
things
that
are
generic
and
overwrite
that
and
make
it
tenant-specific.
So
it
will
work
in
the
tenant
that
we
try
to
deploy
them
to.
Otherwise
it
will
not
work
so
there
the
deployment
part
is
actually
two
scripts.
A
One
is
called
prepare,
their
other
is
called
deploy.
What
they
do
they
prepare
is
getting
access
token
via
graph
api,
with
the
appropriate
permissions.
It's
getting
some
application
information
out
via
graph
because
it
needs
to
get
some
object,
ids
and
app
ids
to
replace
these
policies
so
that
they
are
ready
to
go.
That's
the
prepare
part.
A
A
B
A
A
A
Okay
involve
create
of
the
user.
That
is
actually
from
time
to
time.
I
give
a
blc
training
and
graph
api
is
one
section
is
really
small,
but
it's
just
because
b
to
c
people
need
to
understand
graph,
so
it's
actually
eight
modules
and
the
user
migration
is
one
of
them
paul
newman.
Are
there
any
plans
to
support
throttling
with
graph
api
endpoint
for
powershell
outside
of
the
powershell
sdk?
C
A
Yeah,
I
don't
have
an
answer
for
you,
I'm
sorry
for
the
partial
module.
I
will
make
sure
to
look
into
it
to
see
what
we're
doing,
because
I
mean
that
it's
it's
two
different
teams.
I
mean
you
have
the
graph
team,
the
res
the
different
resource
team,
and
then
you
have
the
tooling
team
that
makes
the
partial
module.
A
D
A
I
don't
have
an
answer
here.
Oh
add
scope,
graph
permissions
to
ou,
oh
okay,
could
this
be
limited
to
subordinates?
Where
manager
is
the
current
user
id
well
exact
details?
I
mean
it
probably
when
we
get
there,
it's
probably
you
you
decide
who
gets
that
role
etc?
Who
can
do
the
permission,
so
you
so
you're
in
control?