Is it possible to execute Graph API Create accessAssignments in a batch with app-only access?

Question

Is it possible to execute Graph API Create accessAssignments in a batch with app-only access?

Kenta Matsunaga 60

Hello, I would like to execute the Create accessAssignments of the Graph API, which is listed on the following site, from a batch process. Please inform me if it is possible to run the targeted API with app-only access from a batch process. https://learn.microsoft.com/en-us/graph/api/delegatedadminrelationship-post-accessassignments?view=graph-rest-1.0&tabs=http

Accepted answer

0 additional answers

Your answer

Answer 1

CarlZhao-MSFT 46,371

Hi @Kenta Matsunaga

No, this API only supports delegated permissions. Batch requests simply merge multiple API requests into one, which must meet the permission requirements of each API. If your batch runs in an application-only context, all API requests in the batch should support application permissions, otherwise the target API will throw an error.

Hope this helps.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.

Kenta Matsunaga 60 Reputation points

2024-01-19T08:55:31.35+00:00

Thank you for your response, CarlZhao. May I ask an additional question? Is there a way to obtain a delegated access token through a batch (daemon app)?
CarlZhao-MSFT 46,371 Reputation points

2024-01-19T09:09:13.96+00:00

Hi @Kenta Matsunaga

It is not possible to obtain a delegated access token through the daemon, you must use a delegation flow (auth code flow or ROPC flow) with user participation to obtain a delegation token.
Kenta Matsunaga 60 Reputation points

2024-01-22T01:08:22.03+00:00

Thank you for your response, CarlZhao.

When I tried to execute 'Create accessAssignments' using the ROPC flow from Postman, I received an "unauthorizedMissingMfaTokenClaim" error. Is it not possible to execute 'Create accessAssignments' with the ROPC flow?
CarlZhao-MSFT 46,371 Reputation points

2024-01-22T02:11:59.75+00:00

Hi @Kenta Matsunaga

Have your users already enabled MFA? If so, then ROPC flow may not be applicable, try switching to auth code flow.
Kenta Matsunaga 60 Reputation points

2024-01-22T06:37:54.6733333+00:00

Thank you for your response, CarlZhao. It seems that MFA is already set up. I was able to execute auth code flow from Postman (web). Is my understanding correct that auth code flow cannot be used from a batch (server only)? If it is available from a batch, could you please tell me the value to set for the parameter 'redirect_uri'?
CarlZhao-MSFT 46,371 Reputation points

2024-01-22T07:02:55.17+00:00

Hi @Kenta Matsunaga

You can of course use the access token for the auth code flow request in your batch, now try passing that token as a request header to your batch.

By the way, the token is not obtained from the batch but from the web browser and authorization server. A batch is just an API request and it is the recipient of the token.
Kenta Matsunaga 60 Reputation points

2024-01-22T08:21:58.97+00:00

Thank you for your response, CarlZhao.

I see, indeed that method would allow us to execute the API from a batch.
However, I'd like to obtain the delegated access token from a batch, but that's not possible, right?
CarlZhao-MSFT 46,371 Reputation points

2024-01-22T08:40:58.2033333+00:00

Hi @Kenta Matsunaga

Yes, batch cannot get the delegated access token.
CarlZhao-MSFT 46,371 Reputation points

2024-01-22T09:06:04.6566667+00:00

Hi @Kenta Matsunaga

Is there anything else I can help you with regarding this issue? If you still need further help, please feel free to let me know. If your question has been solved, then you can click "Accept Answer", which may help members with similar questions find the answer easily. Thank you very much!
Kenta Matsunaga 60 Reputation points

2024-01-23T00:27:50.7366667+00:00

Thank you for your response, CarlZhao. I would like to ask one more thing. I want to initiate the first token issuance via the web, and thereafter use it via batch processes while refreshing the token. Is there a limit to how often or how long I can refresh the token?
CarlZhao-MSFT 46,371 Reputation points

2024-01-25T02:30:20.4133333+00:00

Hi @Kenta Matsunaga

The default lifetime of a refresh token is 90 days, and there is usually no frequency limit for renewing an access token during its lifetime, unless the user or admin has set the sign-in frequency or session length through a Conditional Access policy. https://learn.microsoft.com/en-us/entra/identity-platform/refresh-tokens

Share via

Is it possible to execute Graph API Create accessAssignments in a batch with app-only access?

0 additional answers

Your answer