{"id":6318,"date":"2021-05-11T07:41:13","date_gmt":"2021-05-11T15:41:13","guid":{"rendered":"https:\/\/officedevblogs.wpengine.com\/?p=6318"},"modified":"2021-05-11T07:41:13","modified_gmt":"2021-05-11T15:41:13","slug":"microsoft-graph-mailbag-azure-ad-applications-and-users-for-testing","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/microsoft-graph-mailbag-azure-ad-applications-and-users-for-testing\/","title":{"rendered":"Microsoft Graph Mailbag \u2013 Azure AD applications and users for testing"},"content":{"rendered":"<p>In today\u2019s Microsoft Graph Mailbag post, we cover Azure AD applications and users for testing Microsoft Graph queries in a development environment.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-6319\" src=\"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2021\/05\/image0-1024x347.jpg\" alt=\"Logos for Microsoft Graph, Azure AD, and testing beaker\" width=\"699\" height=\"237\" srcset=\"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2021\/05\/image0-1024x347.jpg 1024w, https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2021\/05\/image0-300x102.jpg 300w, https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2021\/05\/image0-768x260.jpg 768w, https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2021\/05\/image0-1536x521.jpg 1536w, https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2021\/05\/image0.jpg 1800w\" sizes=\"(max-width: 699px) 100vw, 699px\" \/><\/p>\n<p>Please be sure to follow this blog series using\u00a0<a href=\"https:\/\/aka.ms\/MSGraphMailbag\">https:\/\/aka.ms\/MSGraphMailbag<\/a>\u00a0or with RSS using\u00a0<a href=\"https:\/\/developer.microsoft.com\/graph\/blogs\/feed\/?tag=MSGraphMailbag\">https:\/\/developer.microsoft.com\/graph\/blogs\/feed\/?tag=MSGraphMailbag<\/a>.<\/p>\n<h3>Introduction<\/h3>\n<p>When developing solutions powered by Microsoft Graph, I like to think through the different authentication flows that are involved.\u00a0 I ask myself questions such as the following:<\/p>\n<ul>\n<li>Will users interactively log in to the application?<\/li>\n<li>Does the user need to have an elevated Azure AD role assignment?<\/li>\n<li>Does the user have any conditional access policies that may be applied?<\/li>\n<li>What type of credential (password, client secret, client certificate, etc.) will be used?<\/li>\n<\/ul>\n<p>As members of the Microsoft Graph Customer and Partner Experience (CPx) team, our team tests Microsoft Graph requests almost every day. This includes validating new APIs, prototyping solutions, investigating scenarios with customers and partners, and more.\u00a0 Generally, we are testing across a wide variety of hosting environments &#8211; <a href=\"https:\/\/docs.microsoft.com\/en-us\/graph\/powershell\/installation\">Microsoft Graph PowerShell SDK<\/a>, <a href=\"https:\/\/docs.microsoft.com\/en-us\/graph\/use-postman\">Postman<\/a>, and numerous web apps to name a few.\u00a0 As such, it is helpful to have the required components for authentication already configured in a Microsoft 365 developer tenant so we can quickly and easily test the necessary Microsoft Graph endpoints.<\/p>\n<p><em>Note: If you don&#8217;t have a developer tenant, you can sign up for one through our <a href=\"https:\/\/developer.microsoft.com\/en-us\/microsoft-365\/dev-program\">Microsoft 365 Developer Program<\/a>.<\/em><\/p>\n<h3>Sample Azure AD applications<\/h3>\n<p>I provision a few sample Azure AD applications in my development environment.\u00a0 The primary applications include:<\/p>\n<ul>\n<li><span style=\"text-decoration: underline\">Delegated Authentication Graph App<\/span>\n<ul>\n<li>Intended for delegated authentication flows such as device code or authorization code flow<\/li>\n<li>Allow public client flow<\/li>\n<li>Enable implicit grant for access tokens and ID tokens<\/li>\n<\/ul>\n<\/li>\n<li><span style=\"text-decoration: underline\">Application Authentication Graph App<\/span>\n<ul>\n<li>Intended for application authentication flows such as client credentials flow<\/li>\n<li>Configured with client secret and certificate for authentication<\/li>\n<\/ul>\n<\/li>\n<li><span style=\"text-decoration: underline\">Postman Graph App<\/span>\n<ul>\n<li>Intended for delegated or application authentication flows<\/li>\n<li>Redirect URI(s) for Postman callback<\/li>\n<\/ul>\n<\/li>\n<li><span style=\"text-decoration: underline\">Graph Connectors App<\/span>\n<ul>\n<li>Intended for application authentication flow<\/li>\n<li>ExternalItem.ReadWrite.All permission for ingesting content<\/li>\n<\/ul>\n<\/li>\n<li><span style=\"text-decoration: underline\">PowerShell Graph App<\/span>\n<ul>\n<li>Intended for delegated or application authentication flows<\/li>\n<li>Configured with client secret and certificate for authentication<\/li>\n<li>Separate application since generally testing administrative requests with different permissions<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-6320\" src=\"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2021\/05\/Image1.jpg\" alt=\"View of Azure AD portal with sample app registrations\" width=\"635\" height=\"500\" srcset=\"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2021\/05\/Image1.jpg 982w, https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2021\/05\/Image1-300x236.jpg 300w, https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-content\/uploads\/sites\/73\/2021\/05\/Image1-768x605.jpg 768w\" sizes=\"(max-width: 635px) 100vw, 635px\" \/><\/p>\n<h3>Sample Azure AD users<\/h3>\n<p>Aside from testing with different Azure AD applications, I also find it helpful to have a variety of Azure AD users with different configurations. When using a delegated authentication flow, there are a few Microsoft Graph endpoints that require an Azure AD role assignment or Azure AD licensing in addition to normal delegated permissions. The following list is not exhaustive and only a point in time reference as of publish date.<\/p>\n<ul>\n<li><span style=\"text-decoration: underline\">Azure AD domain administrator<\/span>\n<ul>\n<li><a href=\"https:\/\/docs.microsoft.com\/graph\/api\/bitlocker-list-recoverykeys?view=graph-rest-beta#permissions\">Required for querying BitLocker recovery keys on behalf of another user under the \/informationProtection\/bitlocker endpoint<\/a><\/li>\n<\/ul>\n<\/li>\n<li><span style=\"text-decoration: underline\">Reports Reader<\/span>\n<ul>\n<li><a href=\"https:\/\/docs.microsoft.com\/graph\/reportroot-authorization\">Required for querying Microsoft 365 usages reports under the \/reports endpoint<\/a><\/li>\n<\/ul>\n<\/li>\n<li><span style=\"text-decoration: underline\">Security Administrator \/ Security Reader<\/span>\n<ul>\n<li><a href=\"https:\/\/docs.microsoft.com\/graph\/permissions-reference#remarks-10\">Required for querying risky users under the \/riskyUsers endpoint<\/a><\/li>\n<\/ul>\n<\/li>\n<li><span style=\"text-decoration: underline\">Azure AD P1\/P2 licensed user<\/span>\n<ul>\n<li><a href=\"https:\/\/docs.microsoft.com\/graph\/api\/resources\/signin\">Required for querying Azure AD sign-in reports under the auditLogs\/signIns endpoint<\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h3>Automate creating Azure AD resources<\/h3>\n<p>Having sample Azure AD application and users in a single development environment is helpful, but it is better if I can make this a repeatable process.\u00a0 In a future post I will cover the details of automating the creation of these resources.\u00a0 For today\u2019s post though I\u2019m sharing a few automation options to explore.<\/p>\n<ul>\n<li>Microsoft Graph PowerShell SDK\n<ul>\n<li><a href=\"https:\/\/docs.microsoft.com\/en-us\/graph\/powershell\/installation\">PowerShell SDK installation<\/a><\/li>\n<li>Example commands\n<ul>\n<li>New-MgApplication<\/li>\n<li>New-MgUser<\/li>\n<\/ul>\n<\/li>\n<li><a href=\"https:\/\/microsoft365dsc.com\/\">Microsoft365DSC<\/a><\/li>\n<li><a href=\"https:\/\/github.com\/microsoftgraph\/msgraph-cli\">Microsoft Graph CLI (preview)<\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h3>Conclusion<\/h3>\n<p>Having the right Azure AD components ready for testing Microsoft Graph requests can help speed up development when iterating on a solution. In this post, I covered a few questions about the authentication flows or users involved as well as sample Azure AD applications and users to pre-configure in a <a href=\"https:\/\/developer.microsoft.com\/en-us\/microsoft-365\/dev-program\">Microsoft 365 developer tenant<\/a>.<\/p>\n<p>Today\u2019s post was written by <a href=\"https:\/\/twitter.com\/briantjackett\">Brian T. Jackett<\/a>, Senior Program Manager on the Microsoft Graph CPx team. Join us for our next post June 8, 2021.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Learn best practices to configure Azure AD applications and users in your development environment for testing Microsoft Graph queries.<\/p>\n","protected":false},"author":69075,"featured_media":25159,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[3],"tags":[17],"class_list":["post-6318","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-microsoft-graph","tag-msgraphmailbag"],"acf":[],"blog_post_summary":"<p>Learn best practices to configure Azure AD applications and users in your development environment for testing Microsoft Graph queries.<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/posts\/6318","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/users\/69075"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/comments?post=6318"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/posts\/6318\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/media\/25159"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/media?parent=6318"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/categories?post=6318"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/microsoft365dev\/wp-json\/wp\/v2\/tags?post=6318"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}