{"id":2008,"date":"2018-11-09T11:00:26","date_gmt":"2018-11-09T11:00:26","guid":{"rendered":"https:\/\/developer.microsoft.com\/en-us\/office\/blogs\/?p=2008"},"modified":"2018-11-09T11:00:26","modified_gmt":"2018-11-09T11:00:26","slug":"30daysmsgraph-day-9-azure-ad-applications-on-v2-endpoint","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/30daysmsgraph-day-9-azure-ad-applications-on-v2-endpoint\/","title":{"rendered":"30DaysMSGraph \u2013 Day 9 \u2013 Azure AD applications on V2 endpoint"},"content":{"rendered":"<p><a href=\"https:\/\/aka.ms\/30DaysMSGraph\">List of all posts in the #30DaysMSGraph series<\/a><\/p>\n<p>-Today&#8217;s post written by <a href=\"https:\/\/twitter.com\/svarukala\">Srinivas Varukala<\/a><\/p>\n<p>In <a href=\"https:\/\/developer.microsoft.com\/en-us\/graph\/blogs\/30daysmsgraph-day-8-authentication-roadmap-and-access-tokens\">Day 8<\/a> we discussed the authentication roadmap and access tokens which are crucial to make Microsoft Graph requests.\u00a0 Today we&#8217;ll look at registering an Azure Active Directory (Azure AD) application that will be used to communicate with Microsoft Graph.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-2040\" src=\"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/30DaysMSGraph_Day9_Source-1024x380.jpg\" alt=\"\" width=\"800\" height=\"297\" srcset=\"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/30DaysMSGraph_Day9_Source-1024x380.jpg 1024w, https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/30DaysMSGraph_Day9_Source-300x111.jpg 300w, https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/30DaysMSGraph_Day9_Source-768x285.jpg 768w, https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/30DaysMSGraph_Day9_Source.jpg 1280w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/><\/p>\n<p>Before we dive into the steps for registering an Azure AD Application, let us clarify few things.\u00a0 There are two endpoints in Azure AD to register applications, called V1 and V2. In this post we are going to use <del>a preview of<\/del> the new experience Azure AD app registration portal and the V2 endpoint to register the application as that is the recommended approach moving forward.\u00a0 See below diagram adapted from Day 8 future state roadmap with highlighted boxes on the components for today&#8217;s focus.\u00a0 On Day 10, we will show how to register app using V1 endpoint. Please visit the article on\u00a0<a href=\"https:\/\/docs.microsoft.com\/en-us\/azure\/active-directory\/develop\/azure-ad-endpoint-comparison\">Comparing the Azure AD v2.0 endpoint with the v1.0 endpoint<\/a>\u00a0to learn about the differences between these endpoints.\u00a0 For this article we are going to use Azure AD V2.0 endpoint.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-2071\" src=\"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-7-1024x440.png\" alt=\"\" width=\"800\" height=\"344\" srcset=\"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-7-1024x440.png 1024w, https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-7-300x129.png 300w, https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-7-768x330.png 768w, https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-7.png 1262w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/><\/p>\n<h3>Registering the Azure AD V2 App using Azure AD App Registration (GA as of May 2019)<\/h3>\n<p>Open a browser and navigate to the <a href=\"https:\/\/aka.ms\/AppRegistrationsPreview\">App registrations<\/a> in <a href=\"https:\/\/aad.portal.azure.com\/\">Azure AD Portal<\/a>.<\/p>\n<p><del><em><strong>Note<\/strong>: All information and example screenshots are using the preview versions of this registration portal and are subject to change. We will attempt to update this documentation to match after the portal is generally available (GA).\u00a0 Read more about the\u00a0<a href=\"https:\/\/developer.microsoft.com\/en-us\/graph\/blogs\/new-app-registration\/\">New App registrations experience now in public preview<\/a>.<\/em><\/del><\/p>\n<p><em><strong>Note<\/strong><\/em>: Read more about the <a href=\"https:\/\/developer.microsoft.com\/en-us\/identity\/blogs\/new-app-registrations-experience-is-now-generally-available\/\">New App registrations experience is now generally available<\/a>.<\/p>\n<p>Click <strong>+ New registration<\/strong> from the current blade content.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-3089\" src=\"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-0b.png\" alt=\"\" width=\"700\" height=\"163\" srcset=\"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-0b.png 653w, https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-0b-300x70.png 300w\" sizes=\"(max-width: 700px) 100vw, 700px\" \/><\/p>\n<p>On the Register an application page, specify the following values:<\/p>\n<ul>\n<li>Name = msgraph-clientcred-app (or any name that works for you)<\/li>\n<li>Supported account types = &lt;choose the value that applies to your needs&gt;<\/li>\n<li>Redirect URI = Web : <a href=\"https:\/\/localhost:8080\">https:\/\/localhost:8080<\/a><\/li>\n<\/ul>\n<p><em><strong>Note<\/strong>: <\/em><em>The Redirect URI value can be changed later and can also be pointed at a URI that isn&#8217;t actually hosted.<\/em><\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-2065\" src=\"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-1-1024x922.png\" alt=\"\" width=\"700\" height=\"631\" srcset=\"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-1-1024x922.png 1024w, https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-1-300x270.png 300w, https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-1-768x692.png 768w, https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-1.png 1381w\" sizes=\"(max-width: 700px) 100vw, 700px\" \/><\/p>\n<p>Click \u201c<strong>Register<\/strong>\u201d button to register the application. After the app is created you will be directed to the application <strong>Overview<\/strong> page. On this page, copy the <strong>Application (client) ID <\/strong>and<strong> Directory (tenant) ID<\/strong> as you will need them later.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-3085\" src=\"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-2b.png\" alt=\"\" width=\"700\" height=\"344\" srcset=\"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-2b.png 537w, https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-2b-300x147.png 300w\" sizes=\"(max-width: 700px) 100vw, 700px\" \/><\/p>\n<p>Select <strong>Authentication<\/strong> from the current blade navigation pane. Add the URI <a href=\"https:\/\/app.getpostman.com\/oauth2\/callback\">https:\/\/app.getpostman.com\/oauth2\/callback<\/a> as the second redirect URI and click <strong>Save<\/strong>. We will use this URL when calling Microsoft Graph using Postman at a later day .<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-3086\" src=\"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-3b-1024x399.png\" alt=\"\" width=\"800\" height=\"311\" srcset=\"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-3b-1024x399.png 1024w, https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-3b-300x117.png 300w, https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-3b-768x299.png 768w, https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-3b-1536x598.png 1536w, https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-3b.png 1929w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/><\/p>\n<ul>\n<li>Select <strong>Certificates &amp; Secrets<\/strong> from the current blade navigation pane.<\/li>\n<li>Select <strong>New client secret<\/strong>.<\/li>\n<li>On the <strong>Add a client secret<\/strong> dialog, specify the following values:\n<ul>\n<li>Description = Secret1<\/li>\n<li>Expires = In 1 year<\/li>\n<\/ul>\n<\/li>\n<li>Click Add<\/li>\n<\/ul>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-3087\" src=\"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-4b-1024x552.png\" alt=\"\" width=\"800\" height=\"431\" srcset=\"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-4b-1024x552.png 1024w, https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-4b-300x162.png 300w, https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-4b-768x414.png 768w, https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-4b-1536x828.png 1536w, https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-4b.png 1670w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/><\/p>\n<p>After the screen has updated with the newly created client secret, copy the <strong>VALUE<\/strong> of the client secret as you will need it later.<\/p>\n<p><strong>Important<\/strong>: This secret string is never shown again, so make sure you copy it now.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-2069 size-full\" src=\"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-5.png\" alt=\"\" width=\"590\" height=\"168\" srcset=\"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-5.png 590w, https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-5-300x85.png 300w\" sizes=\"(max-width: 590px) 100vw, 590px\" \/><\/p>\n<p>The next step is to set the required permissions to the application to make the Microsoft Graph calls. We will discuss application permissions in more detail on Day 11, but for today understand that there are two categories of permissions:<\/p>\n<ol>\n<li>Delegated Permissions\n<ul>\n<li>Use these permissions when the application runs under the user context. In this case, we are delegating the application to run on behalf of the user.<\/li>\n<\/ul>\n<\/li>\n<li>Application Permissions\n<ul>\n<li>Use these permissions when using client-credential flow (also called app only flow). In this case, the application executes without any user context.<\/li>\n<li>We are adding an application permission in this post.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<p>In a later post we will use the Azure AD Application created in this post to make Microsoft Graph query to list all users in the organization. Accordingly we will add \u201cUser.Read.All\u201d application permission.<\/p>\n<p>Click <strong>API permissions <\/strong>in the current blade navigation pane. Click on the <strong>+ Add a permission<\/strong> button. Select <strong>Microsoft Graph<\/strong>. Select <strong>Application Permissions<\/strong>. Expand the <strong>User<\/strong> category and check the box for <strong>User.Read.All<\/strong> permission.<\/p>\n<p><em><strong>Note<\/strong>: You will see that the <strong>Admin consent required<\/strong> column shows as Yes. This means the Azure AD Admin must grant the permissions before the application can be used to make Microsoft Graph queries.<\/em><\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-3088\" src=\"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-6b-1010x1024.png\" alt=\"\" width=\"800\" height=\"811\" srcset=\"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-6b-1010x1024.png 1010w, https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-6b-296x300.png 296w, https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-6b-768x779.png 768w, https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-6b-1515x1536.png 1515w, https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-6b-24x24.png 24w, https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-6b-48x48.png 48w, https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-6b-96x96.png 96w, https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-6b.png 1648w\" sizes=\"(max-width: 800px) 100vw, 800px\" \/><\/p>\n<p>Back on the <strong>API Permissions<\/strong> screen click <strong>Grant admin consent for &lt;tenantName&gt;<\/strong>, then click <strong>Yes<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"size-full wp-image-2072 aligncenter\" src=\"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-8.png\" alt=\"\" width=\"683\" height=\"121\" srcset=\"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-8.png 683w, https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2018\/11\/Day09-AADAppV2-8-300x53.png 300w\" sizes=\"(max-width: 683px) 100vw, 683px\" \/><\/p>\n<p><em><strong>Note<\/strong>: You must be a domain administrator for Azure AD or similar role in order to grant admin consent.\u00a0 If you do not have appropriate permissions stay tuned for a topic in Day 11 that offers an alternative permission level.<\/em><\/p>\n<h2>Try It Out<\/h2>\n<p>Navigate to the\u00a0<a href=\"https:\/\/aka.ms\/AppRegistrationsPreview\">App registrations<\/a>.\u00a0 Walk through these steps to create an app, assign it permissions, and grant admin consent.<\/p>\n<p><a href=\"https:\/\/github.com\/microsoftgraph\/30DaysMSGraph-TryItOut\/blob\/master\/Day09-AzureADAppV2.md\">Day 9 repo link<\/a><\/p>\n<ol>\n<li>Create a new Azure AD application.<\/li>\n<li>Assign the delegated permission for Mail.Read.<\/li>\n<li>Assign the delegated permission for Calendars.ReadWrite.<\/li>\n<li>Assign the application permission for User.Invite.All.<\/li>\n<li>Grant admin consent to the application.<\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<p>Join us tomorrow as we register an Azure AD application with the V1 endpoint in <a href=\"https:\/\/developer.microsoft.com\/en-us\/graph\/blogs\/30daysmsgraph-day-10-azure-ad-applications-on-v1-endpoint\">Day 10<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In Day 8 we discussed the authentication roadmap and access tokens which are crucial to make Microsoft Graph requests.\u00a0 Today we&#8217;ll look at registering an Azure Active Directory (Azure AD) application that will be used to communicate with Microsoft Graph.<\/p>\n","protected":false},"author":73055,"featured_media":25159,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[3],"tags":[84],"class_list":["post-2008","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-microsoft-graph","tag-30daysmsgraph"],"acf":[],"blog_post_summary":"<p>In Day 8 we discussed the authentication roadmap and access tokens which are crucial to make Microsoft Graph requests.\u00a0 Today we&#8217;ll look at registering an Azure Active Directory (Azure AD) application that will be used to communicate with Microsoft Graph.<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/posts\/2008","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/users\/73055"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/comments?post=2008"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/posts\/2008\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/media\/25159"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/media?parent=2008"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/categories?post=2008"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/tags?post=2008"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}