Access token Graph API

Question

Hi!

I am a developer, and I am trying to connect to the Graph API of Sharepoint.

(My trying to connect is in Visual Studio Code, I need to make an integration in Oracle jDeveloper)

I have access to the tenantID, clientId, thumbprint of the certificate, and the siteID.

I have seen online that it is possible to connect with an authentication library, or by getting a token using POST login.microsoftonline.com:443/{tenantID}/oauth2/v2.0/token, with some information in the body (but creating the client_assertion looks quite difficult).

Both options look quite difficult to use in jDeveloper. Are there any insights, tips or different solutions for connecting to the API?

Answer 1

For calling Microsoft Graph from a daemon (no user interaction) with tenant ID, client ID, and a certificate, the recommended and simplest approach is to use the OAuth 2.0 client credentials flow and let an authentication library (MSAL) handle the token acquisition instead of manually building client_assertion.

Key points from the platform behavior:

• For app-only access, use application permissions on Microsoft Graph (for SharePoint data, typically Sites.Read.All or Sites.FullControl.All on Graph, granted with admin consent).
• The app obtains an access token from Microsoft Entra ID using the client credentials grant.
• The access token is then sent as a Bearer token in the Authorization header when calling Microsoft Graph.

1. Token acquisition pattern (client credentials)

The Microsoft identity platform supports the client credentials flow with either a shared secret or a certificate. With a certificate, the token request looks like this:

POST https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token

Body parameters (certificate-based):

• tenant: Directory tenant ID or domain.
• client_id: Application (client) ID.
• scope: Resource identifier + /.default, for Microsoft Graph: https://graph.microsoft.com/.default.
• client_assertion_type: urn:ietf:params:oauth:client-assertion-type:jwt-bearer.
• client_assertion: A JWT signed with the certificate registered as a credential for the app.
• grant_type: client_credentials.

This is described in the client credentials documentation and is the correct pattern for a daemon or background process.

2. Avoiding manual JWT construction

Instead of hand-building client_assertion in jDeveloper, use an authentication library that:

• Creates and signs the client assertion JWT with the certificate.
• Sends the correct POST request to /oauth2/v2.0/token.
• Caches and refreshes tokens.

The Microsoft Authentication Library (MSAL) is designed for this purpose and is available for multiple platforms. The guidance explicitly recommends using authentication libraries to manage token interactions because they abstract protocol details such as validation, token caching, and secure connections.

If jDeveloper cannot directly use MSAL, a common pattern is:

• Implement a small service (for example, in .NET or Java with MSAL) that exposes an internal endpoint to obtain tokens or to proxy Graph calls.
• jDeveloper calls this internal service instead of implementing the OAuth protocol itself.

3. Using the access token with Microsoft Graph

Once an access token is obtained, call Microsoft Graph by including it in the Authorization header:

GET https://graph.microsoft.com/v1.0/sites/{site-id}/ HTTP/1.1
Host: graph.microsoft.com
Authorization: Bearer {access_token}

The access token is a JWT containing claims about the app (and user if delegated). For app-only scenarios, the claims represent the application permissions granted. Microsoft Graph validates these claims and authorizes the operation.

4. Summary of practical options

• Preferred: Use MSAL in a component that jDeveloper can call (directly or via a small service) to avoid manual JWT creation.
• If manual implementation is required, follow the documented client credentials flow with certificate-based client_assertion and scope set to https://graph.microsoft.com/.default.

---

References:

• Microsoft identity platform and the OAuth 2.0 client credentials flow
• Authentication and authorization basics
• Understanding Microsoft Entra ID and OAuth 2.0 in the context of SharePoint Online modern development