How to access Microsoft Graph

Question

I am building a Teams extension with Microsoft Graph. I use the following code to create a client.

// Initialize DeviceCodeCredential
const credential = new DeviceCodeCredential({
  tenantId: config.tenantId,
  clientId: config.clientId,
  userPromptCallback: (info) => {
    console.log(info.message); // Display the device code message to the user
  },
});

// Create authentication provider for Microsoft Graph
const authProvider = new TokenCredentialAuthenticationProvider(credential, {
  scopes: ['User.Read'], // Specify the required scopes
});

// Initialize Microsoft Graph client
const graphClient = Client.initWithMiddleware({ authProvider: authProvider });

It asked me to sign in: To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code XXXXXXXX to authenticate.

However, after I signed in, the message said that

Please help us maintain device security. Login was successful, but the system administrator requires that the device requesting access must be managed by Microsoft Non-Production to access this resource. Error Code: 530033 Request Id: 4e72476c-27f8-4da4-81e5-6b8c35476900 Correlation Id: a8162939-754f-4ca9-9ef8-5140fd6c42c4 Timestamp: 2024-12-13T10:25:43.024Z 應用程式名稱: Microsoft Azure CLI 應用程式識別碼: 04b07795-8ddb-461a-bbee-02f9e1bf7b46 IP 位址: 2404:f801:8050:3:13b:4377:414e:10a4 裝置識別碼: 3c811fad-a468-42a4-946a-7c468a8bb797 裝置平台: Windows 10 裝置狀態: Compliant

How do I solve this issue and use Microsoft Graph sucessfully?

Thank you.

Answer 1

Talk to your IT Support staff, they have configured policy that prevents token issuing for non-managed devices. Or consider leveraging the client credentials flow instead, so that no user/device component is involved.