Microsoft / Graph API Authenticate after hosting application as a windows service.

Question

Hi,
I have a .NET core application which internally user Microsoft / Graph API which is opening browser to authenticate Application. When I am running via Visual studio everything is working fine, browser open and I am able to authenticate user. But when I hosted this application as a windows service (services.msc) it is not able to open browser. Is there any way to accomplish this.

I cannot authenticate via Password as MFA is enable.

Answer 1

you would register an azure ad app for the service. then define graph api access (the service account will have graphic api admin permissions). You would then authenticate with a client's and secret (or client certificate). This can only be done by an azure ad admin.

If you are using your account, and it doing work on your behalf, then it's a little tricker.:

You would create desktop tray application that would do the authentication (open the browser via msal). the tray app would listen on a port or named pipe. when the service application needed a token, it would remotely call the tray application to get the token. the service app could store the refresh token which has a much longer life (typically 90 days) than an access token.

if you don't want a tray application, then have a windows utility that authenticates and writes the refresh token to a know location (say registry, or better yet protected storage). Just need to remember to run before refresh token expires.