Unable to call graphAPI using On-behalf-of flow from Asp.Net Web API

Question

Hello Support Team,

I am really stuck at a problem since last week, I have already described the problem on stackoverflow, below is the link

https://stackoverflow.com/questions/67724384/unable-to-call-graphapi-using-on-behalf-of-flow-from-asp-net-web-api

However, if you need any more information, I could provide.

Thank you,
Trupti Satardekar

Answer 1

I assume you are talking about Azure AD B2C. If that's the case, this functionality simply does not exist in Azure AD B2C.

For your application to be able to call the graph API on behalf of the user, it needs to have delegated permissions to the graph API. If you check the App Registration > API Permissions blade in Azure AD B2C, you'll see that you are unable to delegate any other scopes other than "offlice_access" and "open_id".

In order for your app to call the graph API, you'll need to use Application Permissions instead, where your app will manually authenticate to Graph with its own identity, and perform the request API operations not on behalf of the logged in user. Such example can be found manage-b2c-users-dotnet-core-ms-graph

Answer 2

The OnBehalfOf Flow is not supported yet in B2C, which is why your scenario doesn't work. As a workaround, user can use "ProfileEdit" flows to edit their information. If a much more involved edit is needed, your only option for now is to build your own app/api which authenticates with an application identity to make those Graph API calls. Again, not on behalf of the user but instead represented by the application identity itself.