This guide provides instructions for configuring Microsoft Graph permissions using Azure portal, Graph Explorer, and Postman, including token and JWT explanations.
This guide provides step-by-step instructions for configuring Microsoft Graph permissions using the Azure portal, Graph Explorer, and Postman. It also explains how tokens and JWTs work within this context.
Before configuring permissions, it is essential to understand Microsoft Graph and its benefits. Microsoft Graph is a unified API endpoint that provides access to data, relationships, and insights across various Microsoft Cloud services—such as Office 365, Azure Active Directory, OneDrive, SharePoint, and more. Developers leverage Microsoft Graph to integrate applications with Microsoft services, performing operations like reading user data, accessing OneDrive files, managing SharePoint sites, and controlling group memberships in Azure AD, all from a single endpoint.By using Microsoft Graph, your application can interact seamlessly with multiple Microsoft services (e.g., Azure AD, OneDrive, SharePoint, OneNote, Booking, Planner) without dealing with multiple endpoints.
Access to Microsoft Graph resources is secured via granular permissions. Permissions are divided into:
Delegated Permissions: Used when your application acts on behalf of a signed-in user.
Application Permissions: Used by daemon or background services where no user is present to delegate permissions.
For example:
User.Read: Allows reading the profile information of the signed-in user.
Directory.Read: Enables reading directory data.
Groups.ReadWrite: Permits reading and writing group information.
Granting consent is a critical step. Users or administrators must consent to the permissions requested by an application; this consent can be applied individually or organization-wide.
Navigate to your Azure Active Directory and open the App registrations section. For demonstration purposes, this guide uses an app registration named AppSecReg.
In the app registration, select API permissions. Initially, you may see a delegated permission already configured, enabling the app to perform actions on behalf of the signed-in user.
To add additional permissions (for example, to read all users in the directory), select Microsoft Graph and then the Application permissions option. Under the Users section, add the User.ReadWrite.All permission.
After adding new permissions, an administrator must grant consent to enable them. Once granted, revisit the API permissions page to verify that the updated permissions are in effect.
Microsoft Graph Explorer is a web-based tool to test API endpoints and explore supported resources. You can use a sample tenant or sign in with your own account.
Sign in with your account and consent to the application’s permissions as necessary.
Run a query to retrieve user details. If the permissions are insufficient, the response will display an “Insufficient privileges” error.
For example, a query to get all user details might return:
The next step is to test API calls using a service principal and Postman.
Open the Endpoints section for your service principal in the Azure portal and select the V1 endpoint (which uses the term “resource”).
In Postman, create a GET request that includes the generated token in the Authorization header. A sample token response in JSON format might look like:
This JWT indicates that only the User.Read.All permission is present. To add further capabilities—such as listing groups—you need to add additional permissions like Group.Read.All.
Test the new permission by executing a GET request for groups in Postman. A successful response returns group details, similar to:
Copy
Ask AI
{ "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#groups", "@microsoft.graph.tips": "Use Select to choose only the properties your app needs, as this can lead to performance improvements. For example: GET groups?$select=assignedLabels,assignedLicenses", "value": [ { "id": "63493487-44ef-4874-8683-825e5e3ad31", "deletedDateTime": null, "classification": null, "createdDateTime": "2023-09-01T11:57:28Z", "creationOptions": [], "displayName": "DNS Administrators Group", "expirationDateTime": null, "groupTypes": [], "mail": null, "mailEnabled": false, ... } ]}
