I have a multi-tenant AAD app in tenant A that accepts tokens issued by tenant B to authenticate its users. The permissions that the app requests are set to the default lowest level - read basic user's profile.

When the user (non-admin) from tenant B logs in, I see the claims, and I've configured the app to send user's group in claims as well. Inside of the group claim, instead of the groups list I am seeing "**src1**" reference, implying that the user is a member of over 200 groups and that I need to query that URI to get the list of those groups. 

When I query that URI, however, I get back an "**Insufficient privileges**" error. I'm actually able to query "/me" URI just fine for the user and see his direct manager and even the office location, but I'm not able to see his or her security groups. 

Are the group claims included in what I'm allowed to read when the user consented to be authenticated by my app, or it's something only an admin can consent to? If I am indeed supposed to see them, what is the right way to access them given the overage claim URI?

Thanks in advance!

UPDATE: 
More info about the code:
I was using a book (not a specific tutorial), and my code lives in *AuthorizationCodeReceived* notification body, and looks like this:

```
var ClientId = "...";
// Notice the "common"
var Authority = "https://login.microsoftonline.com/common";
var appKey = "...";
var resourceId = "https://graph.windows.net";
var code = context.Code;
var authContext = new AuthenticationContext(Authority);
var credential = new ClientCredential(ClientId, appKey);
var result = authContext.AcquireTokenByAuthorizationCode(code, new Uri(HttpContext.Current.Request.Url.GetLeftPart(UriPartial.Path)), credential, resourceId);

var httpClient = new HttpClient();
httpClient.DefaultRequestHeaders.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", result.AccessToken);

// I'm not very sure about this part - I tried different ways, but all request that "work" result in "Insufficient privileges"
var p = new { securityEnabledOnly = true };
string postBody = JsonConvert.SerializeObject(p);
httpClient.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json")); 

var response = httpClient.PostAsync("<the src1 url>", new StringContent(postBody, System.Text.Encoding.UTF8, "application/json")).Result;

```