I have tried creating an Azure Function that applies a Group Lifecycle Policy to a specific group, but it fails with Application permissions.
Using username and password authentication, this works without a problem.
public static string GetAccessTokenForUser(string resourceUri, string aadDomain, string userName, string password)
{
var powershellClientId = "12128f48-ec9e-42f0-b203-ea49fb6af367";
var azureADAuthority = $"https://login.microsoftonline.com/{aadDomain}/oauth/v2/authorize";
var userCreds = new UserPasswordCredential(userName, password);
var authContext = new AuthenticationContext(azureADAuthority, true);
var authResult = AuthenticationContextIntegratedAuthExtensions.AcquireTokenAsync(authContext, resourceUri, powershellClientId, userCreds).GetAwaiter().GetResult();
return authResult.AccessToken;
}
When using ClientId en ClientSecret it always returns 401 Unauthorized error.
public static string GetAccessTokenForClientId(string resourceUri, string aadDomain, string clientId, string clientSecret)
{
var azureADAuthority = $"https://login.microsoftonline.com/{aadDomain}/oauth/v2/authorize";
var clientCreds = new ClientCredential(clientId, clientSecret);
var authContext = new AuthenticationContext(azureADAuthority, true);
var authResult = authContext.AcquireTokenAsync(resourceUri, clientCreds).GetAwaiter().GetResult();
return authResult.AccessToken;
}
Then I do a Get Request using the Access token from the previous function
GET https://graph.microsoft.com/beta/groupLifecyclePolicies
Documentation at https://developer.microsoft.com/en-us/graph/docs/api-reference/beta/api/grouplifecyclepolicy_list states that Application Permissions should work. Access token contains the required scopes, I checked that.
Can anybody confirm?
EDIT 03/05/2018: Since last week, it seems this is working again per documentation. I currently am able to execute all the lifecycle releated requests through my Application Permissions.