Using Microsoft graph for getting an email without real application

Question

Using Microsoft graph for getting an email without real application

Katya Fedorova 40

I am an Automation QA engineer and trying to use Graph for getting an email sent by my platform/site to the random outlook user. As I see the use case of using Graph mostly to get that email in the application on behalf of the user. But my case is different - I want my test framework to retrieve the message, not the application under development. Screenshot 2023-06-16 at 13.52.38

Hence. I don't have a redirect URL, whereas I understand Microsoft identity platform will send authorization code to the app (as I want to send this auth request from the test framework, not from application under development).

The question, can I somehow bypass this redirect URL issue, and is this a common case of using Graph without application but for test automation purposes?

Accepted answer

2 additional answers

Your answer

Answer 1

Hi @Katya Fedorova ,

Thanks for reaching out.

You can use Microsoft Graph API for test automation purposes without a redirect URL. However, you will need to use the client credentials flow instead of the authorization code flow.

The client credentials flow allows your test framework to authenticate directly with Azure AD and obtain an access token without user interaction. This flow is typically used for server-to-server authentication scenarios, but it can also be used for test automation purposes.

To use the client credentials flow, you will need to register your test framework as an Azure AD application and grant it the necessary application permissions rather than delegated permissions to access the Microsoft Graph API**.**

User's image

You can use the client ID and client secret of your Azure AD application to authenticate and obtain an access token.

User's image

Reference - https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow

Hope this will help.

Thanks,

Shweta

Please remember to "Accept Answer" if answer helped you.

Answer 2

Hi @Katya Fedorova

The auth code flow is an interactive authentication flow, it cannot log a user in without using the web interface, this can only be done in the browser UI.

If your security team prohibits the use of application permissions, then you can try to obtain an access token using the ROPC flow, which is available in a delegated context without interacting with the logged-in user in the web interface. However this flow requires a very high degree of trust in the application, as it requires you to hardcode the username/password in the backend.

Hope this helps.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.

Answer 3

Katya Fedorova 40

Hi Shweta!
Thank you a lot for your answer. I see in that case I will need to use only application access, which is forbidden by my InfoSec team.

Let's say I will solve the issue with the redirect. But another issue pops up with using it for automation tests.
I will need to sign in, before getting the authorization code. As I understand I will need to do it each time before running my tests and triggering the Graph API.
Is it possible to sign in without using a web interface, but just API calls?

Shweta Mathur 30,296 Reputation points Microsoft Employee Moderator

2023-06-19T10:07:56.3733333+00:00
@Katya Fedorova

Hi @Katya Fedorova

As CarlZhao-MSFT mentioned, it is possible to sign in without using a web interface. You can use the Resource Owner Password Credentials (ROPC) grant flow to sign in programmatically. The ROPC flow allows an application to sign in the user by directly handling their credentials. This flow requires a high degree of trust in the application and carries risks that are not present in other authentication flows. Therefore, it is not recommended to use this flow in a production environment**.**

To use the ROPC flow, you need to send a POST request to the token endpoint with the user's credentials. Here is an example of how to use the ROPC flow to get an access token:

POST /{tenant}/oauth2/v2.0/token HTTP/1.1 Host: login.microsoftonline.com Content-Type: application/x-www-form-urlencoded grant_type=password &client_id={client_id} &scope={scope} &username={username} &password={password} &client_secret={client_secret}

Replace {tenant} with your tenant ID or name, {client_id} with your application ID, {scope} with the scopes you want to request, {username} with the user's username, {password} with the user's password, and {client_secret} with your application secret if you have one.

After you send the request, you will receive a JSON response that contains an access token, an ID token, and a refresh token. You can use the access token to call the Microsoft Graph API on behalf of the user**.**

Please note that the ROPC flow is not recommended for production environments and should only be used for testing purposes.

Thanks,

Shweta

Share via

Using Microsoft graph for getting an email without real application

2 additional answers

Your answer