Microsoft graph API: Unable to fetch users with the generated access token

Question

I have registered the application in Azure portal and i have generated the client_secret. I require the client grant flow and i have given application permissions also. I have granted the admin consent also as I am the admin myself.

I am able to generate the access token with the given url:

https://login.microsoftonline.com/47be0abf-c6a1-4f04-a665-dceb081c4ff1/oauth2/v2.0/token?client_id=********&client_secret=******&grant_type=client_credentials&scope=User.ReadBasic.All%20User.Read%20User.ReadWrite%20User.Read.All%20User.ReadWrite.All%20Directory.Read.All%20Directory.ReadWrite.All%20Directory.AccessAsUser.All

However, when i use the token generated to access the following url, I get the insufficient privileges message.

https://graph.microsoft.com/v1.0/users
Authorization Bearer eyJ0eXAiOiJKV1QiLCJub25jZSI6IkFRQUJBQUFBQUFEQ29NcGpKWHJ4VHE5Vkc5dGUtN0ZYNndkRlV3aTBKbGlHcWhEWkgybFRlYWh6SUhUX0VsazFaYTFuUHRzNWo3SW5xMDBmbnNNRkpNUWRYdWdVZnpaZ0cxT19uenNPTXpwN2tpUFFIR2VHTnlBQSIsImFsZyI6IlJTMjU2IiwieDV0IjoiQ3RmUUM4TGUtOE5zQzdvQzJ6UWtacGNyZk9jIiwia2lkIjoiQ3RmUUM4TGUtOE5zQzdvQzJ6UWtacGNyZk9jIn0.eyJhdWQiOiJodHRwczovL2dyYXBoLm1pY3Jvc29mdC5jb20iLCJpc3MiOiJodHRwczovL3N0cy53aW5kb3dzLm5ldC80N2JlMGFiZi1jNmExLTRmMDQtYTY2NS1kY2ViMDgxYzRmZjEvIiwiaWF0IjoxNTYwMjUzMDE1LCJuYmYiOjE1NjAyNTMwMTUsImV4cCI6MTU2MDI1NjkxNSwiYWlvIjoiNDJaZ1lQajhVdnBwWGMySEU1WGZwbnZxSG43akFnQT0iLCJhcHBfZGlzcGxheW5hbWUiOiJUdXRvcmlhbCBTYW1wbGUgQXBwIiwiYXBwaWQiOiI2NzMxZGU3Ni0xNGE2LTQ5YWUtOTdiYy02ZWJhNjkxNDM5MWUiLCJhcHBpZGFjciI6IjEiLCJpZHAiOiJodHRwczovL3N0cy53aW5kb3dzLm5ldC80N2JlMGFiZi1jNmExLTRmMDQtYTY2NS1kY2ViMDgxYzRmZjEvIiwib2lkIjoiNjg0ZjkzMjUtNjUyNS00Yjk5LTgwNzktOTEyOGZjZWNlNGViIiwic3ViIjoiNjg0ZjkzMjUtNjUyNS00Yjk5LTgwNzktOTEyOGZjZWNlNGViIiwidGlkIjoiNDdiZTBhYmYtYzZhMS00ZjA0LWE2NjUtZGNlYjA4MWM0ZmYxIiwidXRpIjoiSkZjUE9SSHRGVTJMMWludEpkY2RBQSIsInZlciI6IjEuMCIsInhtc190Y2R0IjoxMzQ0Njc5MzA0fQ.fXEs7eClm5SYXychcKXbTfcc5gtvyyMa5fDWuGu2vqQ4Zc6V0jJSHSeksRiOzYE8SOJXRTmI9vJtbs2XIMFr0CRHeTgoCDReV8JWJ8yhOKiDnc-_2AHtSoBnqt6ibF0eX4AzkyioJd24-uYTSkheC_zDpd6GS3T5T077BU_1M7kpngXDfEICi38VkddcpdBUG8FgHUSPq0S9fCosIB4_JPwspq3QC6jJyoRrj1Yj2oR8FwBA1dpgWq_e0QoGnWXgT6EhBKedjY0hwHGY-F73ndvRlAKKW63JYucdOtRyC2zFDc4DPwhN1nyPlh86_Y0Zru8UTb0QgWRFKbGZwQcEOg

I have tried changing the permission and added and removed the permissions.

{
"error": {
    "code": "Authorization_RequestDenied",
    "message": "Insufficient privileges to complete the operation.",
    "innerError": {
        "request-id": "aa38f822-7325-44ad-9127-3cb4779578bf",
        "date": "2019-06-11T11:42:16"
    }
}

}

Updated : Included the permission screenshot configuration

JWT Debugger output for tokens:

{
  "aud": "https://graph.microsoft.com",
  "iss": "https://sts.windows.net/f77804fb-8607-4e96-9fae-231360cc82b7/",
  "iat": 1560273380,
  "nbf": 1560273380,
  "exp": 1560277280,
  "aio": "42ZgYKjulnV3u/vJZNN0gz3ld2ZpAwA=",
  "app_displayname": "clmapp",
  "appid": "82ad79f2-27c7-4304-92f6-e3ffdb637e72",
  "appidacr": "1",
  "idp": "https://sts.windows.net/f77804fb-8607-4e96-9fae-231360cc82b7/",
  "tid": "f77804fb-8607-4e96-9fae-231360cc82b7",
  "uti": "BpTbRLEb5ECSO3qjslIgAA",
  "ver": "1.0",
  "xms_tcdt": 1376441181
}

Answer 1

You could try following way:

Permission:

Make sure you have following permission:

Grant permission On Azure Portal:

Step:1

Select Application Permission On API permissions menu

Step:2

Select User.ReadWrite.All under Application Permission part But User.Read.All also alright.

Token Request Format:

URL:https://login.microsoftonline.com/YourTenant.onmicrosoft.com/oauth2/token

For V2.0 URL:https://login.microsoftonline.com/YourTenant.onmicrosoft.com/oauth2/v2.0/token

HTTP Verb: POST

grant_type:client_credentials
client_id:b603c7be-a866-4-e6921e61f925
client_secret:Vxf1SluKbguf3wE5oGl/2XDSeZ8wL/Yp8ns4sc=
resource:https://graph.microsoft.com

For V2.0 scope Will be : scope:https://graph.microsoft.com/.default

See the screen shot below:

Decode Token & Confirm permission:

You can use https://jwt.io/ to decode your token to make sure you have required permission: See the below screen shot:

Request For User List:

With your Token Request on this endpoint https://graph.microsoft.com/v1.0/users. See the screen shot below. I have successfully get all the user list.

Answer 2

When using the OAuth 2.0 Client Credentials Grant flow, your scope value should use the built-in .default scope for the resource your are trying to access. This is mentioned in the reference article: Microsoft identity platform and the OAuth 2.0 client credentials flow

In your case, the resource you are trying to access is Microsoft Graph, so your scope value in the token request should be https://graph.microsoft.com/.default:

https://login.microsoftonline.com/{tenant-id-or-domain}/oauth2/v2.0/token
    &grant_type=client_credentials
    &client_id={client-id}
    &client_secret={client-secret}
    &scope=https%3a%2f%2fgraph.microsoft.com%2f.default

Note that for this to succeed, the app's required permissions must be configured (Azure portal > Azure Active Directory > App registrations > API permissions) and granted: