0

I have tried creating an Azure Function that applies a Group Lifecycle Policy to a specific group, but it fails with Application permissions.

Using username and password authentication, this works without a problem.

public static string GetAccessTokenForUser(string resourceUri, string aadDomain, string userName, string password)
    {
        var powershellClientId = "12128f48-ec9e-42f0-b203-ea49fb6af367";
        var azureADAuthority = $"https://login.microsoftonline.com/{aadDomain}/oauth/v2/authorize";
        var userCreds = new UserPasswordCredential(userName, password);
        var authContext = new AuthenticationContext(azureADAuthority, true);
        var authResult = AuthenticationContextIntegratedAuthExtensions.AcquireTokenAsync(authContext, resourceUri, powershellClientId, userCreds).GetAwaiter().GetResult();
        return authResult.AccessToken;
    }

When using ClientId en ClientSecret it always returns 401 Unauthorized error.

public static string GetAccessTokenForClientId(string resourceUri, string aadDomain, string clientId, string clientSecret)
    {
        var azureADAuthority = $"https://login.microsoftonline.com/{aadDomain}/oauth/v2/authorize";
        var clientCreds = new ClientCredential(clientId, clientSecret);
        var authContext = new AuthenticationContext(azureADAuthority, true);
        var authResult = authContext.AcquireTokenAsync(resourceUri, clientCreds).GetAwaiter().GetResult();
        return authResult.AccessToken;
    }

Then I do a Get Request using the Access token from the previous function

GET https://graph.microsoft.com/beta/groupLifecyclePolicies

Documentation at https://developer.microsoft.com/en-us/graph/docs/api-reference/beta/api/grouplifecyclepolicy_list states that Application Permissions should work. Access token contains the required scopes, I checked that.

Can anybody confirm?

EDIT 03/05/2018: Since last week, it seems this is working again per documentation. I currently am able to execute all the lifecycle releated requests through my Application Permissions.

3
  • Can you add details like code, config files or anything that could help the community solve your question ?
    – 3Dos
    Nov 23, 2017 at 8:02
  • I added code samples. Nov 23, 2017 at 8:28
  • 1
    Since last week, it seems this is working again per documentation. I currently am able to execute all the lifecycle releated requests through my Application Permissions. May 3, 2018 at 8:37

1 Answer 1

0

I have exactly same problem - working on application used to manage groups in O365 working on limited user permissions and executing O365 API requests under App permissions.

I tested app working under application permissions (with Directory.ReadWrite.All) and it worked fine back in ~mid Dec. Unfortunately, when tested yesterday, it failed with missing privileges error.

I managed to find this commit to Graph API documentation, which shows what happened.

Can anyone from Graph API team tell if you plan to return this feature in any time soon? This has a lot of valid uses.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.