Microsoft Graph Api MSAL Authentication Issue for using Calendars.ReadWrite. Do clientSecret a mandatory?

Question

I am trying to develop program to sync a server main Outlook Calendar event to personal Account Outlook Calendar. I have some question, Is client secret a mandatory for me access Microsoft Graph API to modified calendar event? Will i able to update calendar event for personal Microsoft account that is not within my tenant directory?

Answer 1

Hello tfs,

Thanks for reaching out!

As per my understanding, the use of client secrets in MSAL authentication for Graph API depends on authentication scenario and the permissions requested.

When your application needs to access graph APIs without user context (Client Credentials flow), then you need client secrets to authenticate your application to Azure AD and obtain an access token.

If your application requests Graph API permissions that requires high level access or admin consent, then you need to use Client credentials flow with a client secret. This is because admin consent requires a higher level of security to prevent unauthorized access to sensitive data. In other authentication scenarios like auth code flow or implicit flow, you don't need a client secret. Instead, you can authenticate your app using Client ID and by configuring redirect URIs to receive tokens after user signs in.

Hope this helps.

If the answer is helpful, please click Accept Answer and kindly upvote. If you have any further questions about this answer, please click Comment.