Accessing the Azure Graph API using Application Identity -

i'm working azure graph api, , notice can't read directories have signed via consent framework.

everything works user-level permissions. is, with

private async task<string> acquiregraphapitokenasync(string objectid, authenticationcontext authcontext) {     var result = await authcontext.acquiretokensilentasync(         graphurl, _clientcredential, new useridentifier(objectid, useridentifiertype.uniqueid));     return result.accesstoken; } 

i can read client data follows:

var authority = string.format(cultureinfo.invariantculture, aadinstance, tenantid); var authcontext = new authenticationcontext(authority, new tokendbcache(userobjectid)); var graphserviceroot = graphurl + '/' + tenantid; var graphclient = new activedirectoryclient(new uri(graphserviceroot), async () => await acquiregraphapitokenasync(userobjectid, authcontext)); try {     var aduser = await graphclient.me.executeasync();     ... } 

sometimes, however, want run similar process in daemon, , fall trouble. in case, need use application identity:

private void auditdirectories(clientcredential clientcredential, ienumerable<azureactivedirectory> directories) {     foreach (var directory in directories)     {         var authcontext = new authenticationcontext(string.format(cultureinfo.invariantculture, aadinstance, directory.domain));         var result = authcontext.acquiretoken(graphurl, clientcredential);         var graphserviceroot = string.format("{0}/{1}", graphurl, directory.tenantid);         var graphclient = new activedirectoryclient(new uri(graphserviceroot), () => task.fromresult(result.accesstoken));         foreach (var user in _userquery.office365users(directory))         {             checkthataccountexistsandisenabled(graphclient, user);         }     } } 

the incoming clientcredential argument obtained client id , client secret of multi-tenant app.

my app has delegated permissions "read directory data" , "enable sign-on , read user's profiles". has application permissions "read directory data" , "read , write directory data", although don't need latter. however, not allow me query graph api. user queries, such as

graphclient.users.where(u => u.displayname == username).executeasync().result.currentpage.firstordefault() 

throw error "insufficient privileges complete operation".

it looks delegated access user identity working without problems, access application identity failing, despite fact have set application permissions @ app level.

i think question misleading in current form. can obtain tokens both user , application identity- , can both things using both acquiretoken , acquiretokensilent. applications cans configured in directory request different privileges depending on whether access resources application identity or delegated access user identity.

in example obtaining tokens user in acquiretokensilent call , app in acquiretoken one, , different privileges configured in app 2 cases lead difference in behavior observed. however, difference dictated overloads used, not inherent difference between acquiretokensilent , acquiretoken.

you can configure app have access azure ad graph api via application permissions drop down (as opposed delegated ones) in portal, note need tenant admin able so.