We are trying to access to Microsoft Graph API using a delegated permission without interaction with the user (In a daemon app). We tried OAuth 2.0 On-Behalf-Of flow but this flow require user to logging in a browser. We tried OAuth 2.0 Resource Owner Password Credentials but this flow is not supported with AD FS used to authenticate on-premises accounts. ¿How can we get a token in an autonomous way?

Hi @ Sebastian M You cannot use delegated permissions within a daemon. The daemon usually runs on the backend without user interaction, it only supports application permissions rather than delegated permissions, and the corresponding authentication flow is the client credentials flow . Hope this helps. If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment .

Using Microsoft Graph with delegated permission in script

Accepted answer

CarlZhao-MSFT 41,286 Reputation points

2023-11-21T06:41:36.43+00:00

Hi @Sebastian M

You cannot use delegated permissions within a daemon. The daemon usually runs on the backend without user interaction, it only supports application permissions rather than delegated permissions, and the corresponding authentication flow is the client credentials flow.

Hope this helps.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.
Please sign in to rate this answer.

1 person found this answer helpful.
Sebastian M 20 Reputation points

2023-11-21T10:27:24.85+00:00

Hi Carl, thanks for your response.

We are trying to build a daemon to process files restricted to only one user drive. If we use Client credentials flow, we will need to use application permissions.

The only way to restrict permissions in application is using Sites.Selected permission, is there any other option?

CarlZhao-MSFT 41,286 Reputation points

2023-11-22T06:48:01.13+00:00

Most application permissions are tenant-wide and you cannot restrict their access.

If you only need to access a specific user's files, then using delegated permissions will be your only option, however delegated permissions are not supported with daemons and you may need to use a delegated authentication flow with user participation to request the token.

Sebastian M 20 Reputation points

2023-11-22T09:33:18.6766667+00:00

Thanks for your support Carl!!
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Using Microsoft Graph with delegated permission in script

0 additional answers

Your answer