How to get Microsoft account guest token?

Question

This article describes Microsoft account guest token. How can I get this token, so that I can use it for my MS Graph API requests? Is it possible to get anonymous guest access code using MS Graph php or JavaScript SDKs? I need to get the guest token to be able anonymously upload to OneDrive publicly shared folder using MS Graph API.

Answer 1

Hi @Romas Markovcinas

Refer to the sample code snippet of the graph JS SDK, which uses the auth code flow for interactive authentication of your guest users:

Using @azure/msal-browser for browser applications

const {
PublicClientApplication,
InteractionType,
AccountInfo
} = require("@azure/msal-browser");
const {
    AuthCodeMSALBrowserAuthenticationProvider,
    AuthCodeMSALBrowserAuthenticationProviderOptions
} = require("@microsoft/microsoft-graph-client/authProviders/authCodeMsalBrowser");

const options: AuthCodeMSALBrowserAuthenticationProviderOptions = {
    account: account, // the AccountInfo instance to acquire the token for.
    interactionType: InteractionType.PopUp, // msal-browser InteractionType
    scopes: ["user.read", "mail.send"] // example of the scopes to be passed
}

// Pass the PublicClientApplication instance from step 2 to create AuthCodeMSALBrowserAuthenticationProvider instance
const authProvider = new AuthCodeMSALBrowserAuthenticationProvider(publicClientApplication, options),

Using @azure/identity for server-side applications

const {
    Client
} = require("@microsoft/microsoft-graph-client");
const {
    TokenCredentialAuthenticationProvider
} = require("@microsoft/microsoft-graph-client/authProviders/azureTokenCredentials");
const {
    AuthorizationCodeCredential
} = require("@azure/identity");

const credential = new AuthorizationCodeCredential(
    "<YOUR_TENANT_ID>",
    "<YOUR_CLIENT_ID>",
    "<AUTH_CODE_FROM_QUERY_PARAMETERS>",
    "<REDIRECT_URL>"
);
const authProvider = new TokenCredentialAuthenticationProvider(credential, {
    scopes: [scopes]
});

Hope this helps. If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.

Answer 2

Hello @Romas Markovcinas , Azure AD cannot issue access tokens to anonymous users. You can, however, authenticate and get an access token for applications/service principals using the client credentials flow from your application. Keep in mind application permissions are regarded as highly privileged thus you gotta be careful when developing the rules to allow and serve calls, specially when they're anonymous.

For JavaScript take a look to:

• Creating an instance of TokenCredentialAuthentication
• Make requests to the graph
• Example (upload a new file)

For PHP take a look to:

• Authenticate with the Microsoft Graph service
• Call Microsoft Graph using the beta endpoint and models
• Upload an item

Let us know if you need additional assistance. If the answer was helpful, please accept it and rate it so that others facing a similar issue can easily find a solution.