How to Instantiate GraphServiceClient inside an azure function?

Question

How to Instantiate GraphServiceClient inside an azure function?

Fareeha Sattar Shaikh 65

Hello,

I am trying to create an azure function which uses graph api to get the authenticated user's profile from azure ad.

I was able to add authentication of microsoft in the azure function app, but now when I try to create GraphServiceClient, all the resources on the internet, are not working in my case. Maybe it is due to the recent update of Microsoft Graph.

I have tried following ways,

//Method 1
var confidentialClientApplication = ConfidentialClientApplicationBuilder
                                                        .Create(Constants.AppId)
                                                        .WithTenantId(Constants.TenantId)
                                                        .WithClientSecret(Constants.ClientSecret)
                                                        .Build();


            ClientCredentialProvider clientCredentialProvider = new ClientCredentialProvider(confidentialClientApplication);

            GraphServiceClient _client = new GraphServiceClient(clientCredentialProvider);

//Method2


 ClientSecretCredential clientSecretCredential = new ClientSecretCredential(Constants.TenantId, Constants.AppId, Constants.ClientSecret);
            GraphServiceClient _client = new GraphServiceClient(clientSecretCredential, Constants.scope); ;

Even the microsoft's documentation suggests the second method, which is not working. By not working I mean, it is not even compiling, there is no such constructor in GraphServiceClient.

Kindly, suggest what should I do?

Accepted answer

0 additional answers

Your answer

Answer 1

CarlZhao-MSFT 46,371

Hi @Fareeha Sattar Shaikh

Refer to my c# code snippet, it uses client credential provider for authentication, you just need to have Azure.Identity and Microsoft.Graph dependency packages. I've tested it locally and it compiles and runs perfectly.

using Azure.Identity;  
using Microsoft.Graph;  
          
var scopes = new[] { "https://graph.microsoft.com/.default" };  
            
var tenantId = "tenant id";  
      
// Values from app registration  
var clientId = "client id";  
var clientSecret = "client secret";  
      
// using Azure.Identity;  
var options = new TokenCredentialOptions  
{  
AuthorityHost = AzureAuthorityHosts.AzurePublicCloud  
};  
      
// https://learn.microsoft.com/dotnet/api/azure.identity.clientsecretcredential  
var clientSecretCredential = new ClientSecretCredential(  
    tenantId, clientId, clientSecret, options);  

// get accessToken          
var accessToken = await clientSecretCredential.GetTokenAsync(new Azure.Core.TokenRequestContext(scopes) { });  
      
Console.WriteLine(accessToken.Token);  
   
var graphClient = new GraphServiceClient(clientSecretCredential, scopes);

Hope this helps.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.

Fareeha Sattar Shaikh 65

Hello, thanks. Could you also please show me how to test this locally in postman? To me it is giving 500 Internal error even after publishing in azure. If you could show me how to test it, that would be great.

I want to get the user profile of the signed in user. I have enabled microsoft authentication in the azure app as well.

it gives this error:

System.Private.CoreLib: Exception while executing function: GetUser. Microsoft.Kiota.Http.HttpClientLibrary: Exception of type 'Microsoft.Graph.Models.ODataErrors.ODataError' was thrown.

I tried it like this:

     var scopes = new[] { "https://graph.microsoft.com/.default" };
            // using Azure.Identity;  
            var options = new TokenCredentialOptions
            {
                AuthorityHost = AzureAuthorityHosts.AzurePublicCloud
            };

            // https://learn.microsoft.com/dotnet/api/azure.identity.clientsecretcredential  
            var clientSecretCredential = new ClientSecretCredential(
                Constants.TenantId, Constants.AppId, Constants.ClientSecret, options);

            // get accessToken          
            var accessToken = await clientSecretCredential.GetTokenAsync(new Azure.Core.TokenRequestContext(scopes) { });

            log.LogInformation(accessToken.Token);

            var graphClient = new GraphServiceClient(clientSecretCredential, scopes);
            var user = await graphClient.Me.GetAsync();
            string responseMessage =  $"Hello, {user.GivenName} . This HTTP triggered function executed successfully.";

CarlZhao-MSFT 46,371 Reputation points

2023-03-17T03:00:12.0766667+00:00
Hi @Fareeha Sattar Shaikh

The client credentials flow is an unattended authentication flow that cannot be used to obtain the user profile of the signed-in user, because your user is not participating in the sign-in. It can only get profiles of other users in the tenant:

var result = await graphClient.Users["{user-id}"].GetAsync();

If you want to get the logged-in user information, then you should use a delegated authentication flow, such as auth code flow or ROPC flow.

CarlZhao-MSFT 46,371

Hi @Fareeha Sattar Shaikh

Authorization code provider:

var scopes = new[] { "User.Read.All" };

// Multi-tenant apps can use "common",
// single-tenant apps must use the tenant ID from the Azure portal
var tenantId = "common";

// Values from app registration
var clientId = "YOUR_CLIENT_ID";
var clientSecret = "YOUR_CLIENT_SECRET";

// For authorization code flow, the user signs into the Microsoft
// identity platform, and the browser is redirected back to your app
// with an authorization code in the query parameters
var authorizationCode = "AUTH_CODE_FROM_REDIRECT";

// using Azure.Identity;
var options = new TokenCredentialOptions
{
    AuthorityHost = AzureAuthorityHosts.AzurePublicCloud
};

// https://learn.microsoft.com/dotnet/api/azure.identity.authorizationcodecredential
var authCodeCredential = new AuthorizationCodeCredential(
    tenantId, clientId, clientSecret, authorizationCode, options);

var graphClient = new GraphServiceClient(authCodeCredential, scopes);

CarlZhao-MSFT 46,371

Hi @Fareeha Sattar Shaikh

Username/password provider:

var scopes = new[] { "User.Read.All" };

// Multi-tenant apps can use "common",
// single-tenant apps must use the tenant ID from the Azure portal
var tenantId = "common";

// Value from app registration
var clientId = "YOUR_CLIENT_ID";

// using Azure.Identity;
var options = new TokenCredentialOptions
{
    AuthorityHost = AzureAuthorityHosts.AzurePublicCloud
};

var userName = "******@contoso.com";
var password = "P@ssword1!";

// https://learn.microsoft.com/dotnet/api/azure.identity.usernamepasswordcredential
var userNamePasswordCredential = new UsernamePasswordCredential(
    userName, password, tenantId, clientId, options);

var graphClient = new GraphServiceClient(userNamePasswordCredential, scopes);

CarlZhao-MSFT 46,371 Reputation points

2023-03-17T03:24:02.5466667+00:00

Hi @Fareeha Sattar Shaikh

Using the Postman test:

PS:

Auth URL: https://login.microsoftonline.com/{tenant id}/oauth2/v2.0/authorize.

Access Token URL: https://login.microsoftonline.com/{tenant id}/oauth2/v2.0/token.

Hope this helps.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.
Fareeha Sattar Shaikh 65 Reputation points

2023-03-17T13:40:06.5266667+00:00

Hi @CarlZhao-MSFT thank you so much for all the support and snippets. I just have one small thing to ask, if I use User.Read with delegated permission for graphClient.Me.GetAsync request, using Interactive Browser Credential. It is working fine for local host. But if I publish the function (as mentioned before, I am implementing all this inside an azure function) and use my published uri as callback uri, it results in error, And it doesn't work.

My question is, does graphClient.Me.GetAsync with Interactive Browser Credential only works for localhost? And if yes, then you mentioned above Authorization Code Flow, in that case again if I am testing it in postman I can fetch the access token and use it in the request. But if all this is done inside an azure function, how will I get the access token to use it for graph api?
Fareeha Sattar Shaikh 65 Reputation points

2023-03-17T16:48:01.86+00:00

Another thing, if I am using the authentication in Azure Function. And, trying to get the identity name through ClaimPrinciple. It works when deployed in the AZURE. But it doesn't work in the Postman? It returns empty. Any idea why?

Share via

How to Instantiate GraphServiceClient inside an azure function?

0 additional answers

Your answer