ChangeIntelIT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources or documents need attention: 258/260 feeds/APIs · 416/439 docs · checked 11:43 UTC Customize Public modeDiscuss ChangeIntel on Discord

Graph application access

This page's changes and edits · All guidance changes

Microsoft's edit ·

[Freshness] Lightweight freshness passes

Microsoft's commit message in microsoftgraph/microsoft-graph-docs-contrib · commit 6f6ea4b · +20 −20 lines · also on GitHub

⋯ 7 unchanged lines
88 ms.localizationpriority: high
99 ms.subservice: entra-applications
1010 ms.custom: graphiamtop20, sfi-image-nochange
11 −ms.date: 08/26/2024
11 +ms.date: 08/29/2025
1212 #customer intent: As a developer, I want to understand how my app can call Microsoft Graph on behalf of a signed-in user to access resources in a tenant.
1313 ---
1414
1515 # Get access without a user
1616
17 −To call Microsoft Graph, an app must obtain an access token from the Microsoft identity platform. This access token includes information about whether the app is authorized to access Microsoft Graph on behalf of a signed-in user or with its own identity. This article provides guidance on how an app can [access Microsoft Graph with its own identity](./auth/auth-concepts.md#access-scenarios), also called *app-only access*.
17 +To call Microsoft Graph, an app must get an access token from the Microsoft identity platform. This access token shows whether the app is authorized to access Microsoft Graph on behalf of a signed-in user or with its own identity. This article explains how an app can [access Microsoft Graph with its own identity](./auth/auth-concepts.md#access-scenarios), also called *app-only access*.
1818
19 −This article details the raw HTTP requests involved for an app to call Microsoft Graph with its own identity using a popular flow called the [OAuth 2.0 client credentials grant flow](/entra/identity-platform/v2-oauth2-client-creds-grant-flow). Alternatively, you can avoid writing raw HTTP requests and use a Microsoft-built or supported authentication library that helps you to get access tokens and call Microsoft Graph. For more information, see [Use the Microsoft Authentication Library (MSAL)](#use-the-microsoft-authentication-library-msal).
19 +This article explains the raw HTTP requests an app makes to call Microsoft Graph with its own identity by using the popular [OAuth 2.0 client credentials grant flow](/entra/identity-platform/v2-oauth2-client-creds-grant-flow). Typically, you don't need to write raw HTTP requests and instead use a Microsoft-built or supported authentication library that helps you get access tokens and call Microsoft Graph. For more information, see [Use the Microsoft Authentication Library (MSAL)](#use-the-microsoft-authentication-library-msal).
2020
2121 In this article, you complete the following steps in using the client credentials flow:
2222
2323 1. Configure Microsoft Graph application permissions on the app.
24 −2. Request administrator consent.
25 −3. Request an access token.
26 −4. Call Microsoft Graph using the access token.
24 +1. Request administrator consent.
25 +1. Request an access token.
26 +1. Call Microsoft Graph by using the access token.
2727
2828 ## Prerequisites
2929
3030 Before proceeding with the steps in this article:
3131
3232 1. Understand the authentication and authorization concepts in the Microsoft identity platform. For more information, see [Authentication and authorization basics](auth/auth-concepts.md).
33 −2. Register the app with Microsoft Entra ID. For more information, see [Register an application with the Microsoft identity platform](auth-register-app-v2.md). Save the following values from the app registration:
33 +1. Register the app with Microsoft Entra ID. For more information, see [Register an application with the Microsoft identity platform](auth-register-app-v2.md). Save the following values from the app registration:
3434 - The application ID (referred to as Object ID on the Microsoft Entra admin center).
3535 - A client secret (application password), a certificate, or a federated identity credential.
3636 - A redirect URI for the app to receive token responses from Microsoft Entra ID.
⋯ 3 unchanged lines
4040
4141 Microsoft Graph exposes [application permissions](./permissions-overview.md#application-permissions) for apps that call Microsoft Graph with their own identity. These permissions always require administrator consent.
4242
43 −You preconfigure the application permissions the app needs when you register the app. An administrator can consent to these permissions either using the [Microsoft Entra admin center](https://entra.microsoft.com) when they install the app in their organization, or you can provide a sign-up experience in the app through which administrators can consent to the permissions you configured. Once Microsoft Entra ID records the administrator consent, the app can request tokens without having to request consent again.
43 +Preconfigure the application permissions the app needs when you register the app. An administrator can consent to these permissions either by using the [Microsoft Entra admin center](https://entra.microsoft.com) when they install the app in their organization, or you can provide a sign-up experience in the app through which administrators can consent to the permissions you configured. Once Microsoft Entra ID records the administrator consent, the app can request tokens without having to request consent again.
4444
4545 To configure application permissions for the app in the app registrations experience on the Microsoft Entra admin center, follow these steps:
4646
⋯ 11 unchanged lines
5858
5959 ## Step 2: Request administrator consent
6060
61 −Administrators can grant the permissions your app needs at the [Microsoft Entra admin center](https://entra.microsoft.com). However, when you don't have access to the Microsoft Entra admin center, you can provide a sign-up experience for administrators by using the Microsoft identity platform `/adminconsent` endpoint.
61 +Administrators can grant the permissions your app needs at the [Microsoft Entra admin center](https://entra.microsoft.com). However, if you don't have access to the Microsoft Entra admin center, you can provide a sign-up experience for administrators by using the Microsoft identity platform `/adminconsent` endpoint.
6262
6363 > [!IMPORTANT]
6464 >
⋯ 45 unchanged lines
110110
111111 | Parameter | Description
112112 |:--------------|:------------
113 −| tenant | The tenant that granted your application the permissions that it requested, in GUID format.
114 −| state | A value that is included in the request that also is returned in the token response. It can be a string of any content that you want. The state is used to encode information about the user's state in the app before the authentication request occurred, such as the page or view they were on.
113 +| tenant | The tenant that grants your application the permissions that it requested, in GUID format.
114 +| state | A value that is included in the request that also is returned in the token response. It can be a string of any content that you want. The state encodes information about the user's state in the app before the authentication request occurred, such as the page or view they were on.
115115 | admin_consent | Set to **True**.
116116
117117 ## Step 3: Request an access token
118118
119 −In the OAuth 2.0 client credentials grant flow, you use the application ID and client secret values that you saved when you registered your app to request an access token directly from the Microsoft identity platform `/token` endpoint.
119 +In the OAuth 2.0 client credentials grant flow, use the application ID and client secret values that you saved when you registered your app to request an access token directly from the Microsoft identity platform `/token` endpoint.
120120
121 −You specify the preconfigured permissions by passing `https://graph.microsoft.com/.default` as the value for the `scope` parameter in the token request.
121 +Specify the preconfigured permissions by passing `https://graph.microsoft.com/.default` as the value for the `scope` parameter in the token request.
122122
123123 ### Token request
124124
⋯ 29 unchanged lines
154154 |:--------------|:----------|:------------
155155 | tenant | Required | The tenant that you want to request permission from. The value can be in GUID or a friendly name format.
156156 | client_id | Required | The application ID that the [Azure app registration portal](https://go.microsoft.com/fwlink/?linkid=2083908) assigned when you registered your app.
157 −| scope | Required | The value passed for the **scope** parameter in this request should be the identifier (app ID URI) of the resource you want, affixed with the `.default` suffix. For example, the Microsoft Graph resource app ID URI is `https://graph.microsoft.com/`. For Microsoft Graph, the value of **scope** is therefore `https://graph.microsoft.com/.default`. This value informs the Microsoft identity platform endpoint to include in the access token all the app-level permissions the admin has consented to.
157 +| scope | Required | The value passed for the **scope** parameter in this request should be the identifier (app ID URI) of the resource you want, affixed with the `.default` suffix. For example, the Microsoft Graph resource app ID URI is `https://graph.microsoft.com/`. For Microsoft Graph, the value of **scope** is therefore `https://graph.microsoft.com/.default`. This value informs the Microsoft identity platform endpoint to include in the access token all the app-level permissions the admin consented to.
158158 | client_secret | Required | The client secret that you generated for your app in the app registration portal. Ensure that it's URL encoded.
159159 | grant_type | Required | Must be `client_credentials`.
160160
⋯ 19 unchanged lines
180180
181181 ## Step 4: Use the access token to call Microsoft Graph
182182
183 −After you have an access token, the app uses it to call Microsoft Graph by attaching the access token as a **Bearer** token to the **Authorization** header in an HTTP request. The following request gets all users in the tenant. The app must have the _User.Read.All_ permission to call this API.
183 +After you get an access token, the app uses it to call Microsoft Graph by attaching the access token as a **Bearer** token to the **Authorization** header in an HTTP request. The following request gets all users in the tenant. The app must have the _User.Read.All_ permission to call this API.
184184
185185 # [HTTP](#tab/http)
186186 ```http
⋯ 11 unchanged lines
198198
199199 ---
200200
201 −A successful response looks like this (some response headers have been removed):
201 +A successful response looks like this (some response headers are removed):
202202
203203 ```json
204204 HTTP/1.1 200 OK
⋯ 46 unchanged lines
251251 - [Background services (daemons)](/entra/identity-platform/scenario-daemon-app-registration) that run on a server without a signed-in user.
252252 - Apps that have a signed-in user but also call Microsoft Graph with their own identity. For example, to use functionality that requires more elevated privileges than the user has.
253253
254 −In this article, the app used a client secret as the credential. You can optionally configure a certificate or a federated identity credential.
254 +In this article, the app uses a client secret as the credential. You can optionally configure a certificate or a federated identity credential.
255255
256256 For more information about apps that call Microsoft Graph with their own identity and use the client credentials flow, see [Authentication flows and application scenarios: Daemon app that calls a web API in the daemon's name](/entra/identity-platform/authentication-flows-app-scenarios#daemon-app-that-calls-a-web-api-in-the-daemons-name).
257257
258258 ## Use the Microsoft Authentication Library (MSAL)
259259
260 −In this article, you walked through the low-level protocol details required only when manually crafting and issuing raw HTTP requests to execute the client credentials flow. In production apps, use a [Microsoft-built or supported authentication library](/entra/identity-platform/msal-overview), such as the Microsoft Authentication Library (MSAL), to get security tokens and call protected web APIs such as Microsoft Graph.
260 +In this article, you see the low-level protocol details required only when manually crafting and issuing raw HTTP requests to execute the client credentials flow. In production apps, use a [Microsoft-built or supported authentication library](/entra/identity-platform/msal-overview), such as the Microsoft Authentication Library (MSAL), to get security tokens and call protected web APIs such as Microsoft Graph.
261261
262 −MSAL and other supported authentication libraries simplify the process for you by handling details such as validation, cookie handling, token caching, and secure connections; allowing you to focus on the functionality of your application.
262 +MSAL and other supported authentication libraries simplify the process for you by handling details such as validation, cookie handling, token caching, and secure connections. These libraries let you focus on the functionality of your application.
263263
264264 Access the [Microsoft identity platform code samples](/entra/identity-platform/sample-v2-code?tabs=apptype#service--daemon) to see how to use MSAL to get access tokens and call Microsoft Graph.
265265
266266 ## Related content
267267
268 −- Explore [Microsoft Graph tutorials](/graph/tutorials) for code samples that are built using different SDKs to create basic applications that authenticate using certificate-based credentials to access data in app-only scenarios.
268 +- Explore [Microsoft Graph tutorials](/graph/tutorials) for code samples that use different SDKs to create basic applications that authenticate with certificate-based credentials to access data in app-only scenarios.
269269 - [Add a certificate to an app using Microsoft Graph](/graph/applications-how-to-add-certificate) shows a step-by-step process to add a certificate to an app for certificate-based authentication and app-only access to data.

Microsoft's Markdown source from microsoftgraph/microsoft-graph-docs-contrib, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 09:24 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 20 Oct 11:43 UTC · 258 of 260 readable · 256 fully read · documentation 416/439 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.