How to authenticate Graph API to get members of a Microsoft tenant from a PME tenant service

Yu Kang 0 Microsoft Employee

Hello,

I have a service that needs to call the Graph API to retrieve the members of a specific group in a Microsoft tenant. Due to security requirements, I need to move the service to a PME tenant.

What is the authentication process to make Graph API calls from a PME tenant? Do I need to request a service principal in the PME tenant and grant it Graph API read permissions?

1 answer

CarlZhao-MSFT 44,766 Reputation points

2024-06-12T09:23:17.69+00:00

Hi @Yu Kang

Yes, you need to grant GroupMember.Read.All application permission to your service principal in the PME tenant and grant administrator consent for this permission.

Next, authenticate your service principal using the client credentials flow to obtain an access token, and then use the token as a request header to call the GET /groups/{id}/members API to get the list of members of a specific group.

Hope this helps.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.
Please sign in to rate this answer.
Yu Kang 0 Reputation points Microsoft Employee

2024-06-12T13:35:42.8533333+00:00

Thank you @Carl Zhao! Just to double confirm, I will able to get members of Microsoft group even though my app and SP are in PME tenant ?

CarlZhao-MSFT 44,766 Reputation points

2024-06-13T02:20:45.68+00:00

Hi @Yu Kang

What is the full name of "PME"?

Yu Kang 0 Reputation points Microsoft Employee

2024-06-13T03:35:20.52+00:00

It is another tenant similar with Microsoft tenant. PME (Private Microsoft Environment)

CarlZhao-MSFT 44,766 Reputation points

2024-06-13T07:05:31.01+00:00

Hi @Yu Kang

I think it functions the same in all tenants, as long as your app has the necessary Graph API permissions in the PME tenant, it will be able to call the Graph API to get the list of members of a specific group in the PME tenant.

Yu Kang 0 Reputation points Microsoft Employee

2024-06-13T07:58:29.8666667+00:00

Thank you @CarlZhao-MSFT !

The key point is that our app and service should be in PME tenant.

But we'd like to get the members of Microsoft Tenant group.

I know it is doable to get Microsoft tenant groups with Microsoft app. PME tenant groups with PME app.

However, is it doable to get Microsoft tenant groups with PME app? Since when I am login with my PME account to Azure, I cannot see the Microsoft groups.

In other words, can I list all groups under all tenant once I get the **GroupMember.Read.All **permission for an app under any tenant?

CarlZhao-MSFT 44,766 Reputation points

2024-06-13T08:10:10.1166667+00:00

OK, I think I understand what you mean now.

You want to use the PME tenant application to access the group members of the MS tenant, right?

If yes, can you configure your application as a multi-tenant application?

CarlZhao-MSFT 44,766 Reputation points

2024-06-13T08:14:49.1433333+00:00

*In other words, can I list all groups under all tenant once I get the **GroupMember.Read.All *permission for an app under any tenant?

I think yes, once your app has obtained the GroupMember.Read.All application permission for the target tenant, then you will be able to retrieve the group members of the target tenant.

CarlZhao-MSFT 44,766 Reputation points

2024-06-14T01:42:58.12+00:00

Hi @Yu Kang

Hope things are going well. I am writing to see if the above suggestions help. If there's anything else we can help, feel free to let us know.

Yu Kang 0 Reputation points Microsoft Employee

2024-06-14T07:33:30.88+00:00

Thank you @CarlZhao-MSFT !

Let me try to create an app with multi tenant. Thanks for your help again!
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How to authenticate Graph API to get members of a Microsoft tenant from a PME tenant service

1 answer

Your answer