c# - Azure AD b2b "Read all users' basic profiles" permission

Question

I have delegated user permission User.ReadBasic.All. In the documentation, it states this

"Allows the app to read a basic set of profile properties of other users in your organization on behalf of the signed-in user. This includes display name, first and last name, email address, open extensions and photo. Also allows the app to read the full profile of the signed-in user."

How can I get all users with basic profiles?

var accessToken = authContext
    .AcquireTokenAsync(graphResourceId, new ClientCredential(clientId, secret))
    .Result
    .AccessToken;

var graphserviceClient = new GraphServiceClient(
    new DelegateAuthenticationProvider(requestMessage => {
        requestMessage.Headers.Authorization = new AuthenticationHeaderValue("bearer", accessToken);
        return Task.FromResult(0);
    }));

Can you please confirm my "Authority" URL is correct or not?

string authority = "https://login.microsoftonline.com/{tenantId}/common/oauth2/v2.0/token?&response_type=code&scope=openid%20profile%20User.Read%20User.ReadWrite%20User.ReadBasic.All";
AuthenticationContext authContext = new AuthenticationContext(authority);
var accessToken = authContext
    .AcquireTokenAsync(graphResourceId, new ClientCredential(clientId, secret))
    .Result
    .AccessToken;

标签： c#microsoft-graph-api

Answer 1

You can hit the Graph API users/<email_id> endpoint (https://graph.microsoft.com/v1.0/users/<email_id_of_the_user>) with the proper Bearer token for getting the basic details of other users.

You can try that out in the Graph Explorer as well - https://developer.microsoft.com/en-us/graph/graph-explorer#