{"id":2055,"date":"2018-11-12T11:00:54","date_gmt":"2018-11-12T18:00:54","guid":{"rendered":"https:\/\/developer.microsoft.com\/en-us\/office\/blogs\/?p=2055"},"modified":"2018-11-12T11:00:54","modified_gmt":"2018-11-12T18:00:54","slug":"30daysmsgraph-day-12-authentication-and-authorization-scenarios","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/30daysmsgraph-day-12-authentication-and-authorization-scenarios\/","title":{"rendered":"30DaysMSGraph \u2013 Day 12 \u2013 Authentication and authorization scenarios"},"content":{"rendered":"

List of all posts in the #30DaysMSGraph Series<\/a><\/p>\n

Today\u2019s post written by Jason Johnston<\/a><\/p>\n

In Day 11<\/a> we discussed Access Tokens which are crucial to make Microsoft Graph requests.\u00a0 Today we’ll look at the various authentication scenarios that are possible when querying with Microsoft Graph.<\/p>\n

\"\"<\/p>\n

OAuth 2.0 flows<\/h2>\n

Azure AD implements several auth scenarios as defined by the OAuth 2.0 specification<\/a>. Let\u2019s take a look at each one.<\/p>\n

Authorization code grant<\/h2>\n

The authorization code grant flow<\/a> is probably the most commonly-used flow for obtaining access tokens. This flow is separated into two distinct parts: the authentication\/authorization part, and the token request.<\/p>\n

First, the user is sent to the Azure Active Directory (Azure AD) login page. In a web app, this is a simple redirect to the site. In a native application, this involves opening up a browser dialog to the Azure AD site. The URL contains parameters that identify the application making the request and the requested permissions scopes. If this is the first time the user has used the application (or if the requested permissions have changed since the last time the user used the application), a list of the requested permissions are presented to the user, giving them a chance to review and approve or deny the permissions.<\/p>\n

If the user approves the requested permissions, the browser redirects back to the application with an authorization code. The app can then send a POST request with that authorization code and the application\u2019s secret to the Azure AD token endpoint to get an access token.<\/p>\n

Types of permissions<\/h3>\n

Apps that use this flow make use of delegated permissions. The access tokens returned from this flow always have a user context.<\/p>\n

When to use authorization code grant<\/h3>\n

This flow is the best choice for your app if your app:<\/p>\n