Enables Client Credentials to call Microsoft Graph #109
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There is a setting in Microsoft Azure Active Directory that prevents guest users from retrieving graph data. Including the group display name, which is used in group synchronization.
https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/users-restrict-guest-permissions
With this setting set to
restricted
, the graph api returns empty group objects and therefore doesn't sync groups.This PR adds a new option to allow the use of client credentials. So instead of granting an application
Directory.AccessAsUser.All (Delegated)
you need to give itDirectory.Read.All (Application)
.Directory.Read.All
is the least most privileged permission required as per https://docs.microsoft.com/en-us/graph/api/user-list-transitivememberof.As the application permissions are granted for the tenant, this setting cannot be used with multi tenant enabled.
The initial
authContext.acquireTokenByAuthorizationCode
is still required to retrieve the user information from the id token claims, asauthContext.acquireToken
wont retrieve this data.