We've migrated to a new tenant where I work. As such we are trying to re-add our applications into Azure AD. We have a documented process that has worked in the past in order to add applications for our MVC and WebAPI projects. However, we've been getting errors when attempting to query the Graph API. In the example application we've used the code from here to create a custom authorize attribute that allows us to group based authentication. After debugging the /Utilities/GraphHelper.cs we've determined that the application is getting a Status Error of 403 with a message that states: "Insufficient privileges to complete the operation."

After doing a bit of research I was able to replicate the Authentication process in Fiddler.

Action Method: POST

URL: <https://login.windows.net/[tennantName]/oauth2/token?api-version=1.0>

Header Block: 

```
Content-Type: application/x-www-form-urlencoded 
Host: login.windows.net
Content-Length: 180
Expect: 100-continue 
Connection: Keep-Alive

```

RequestBody:

```
grant_type=client_credentials&resource=https%3a%2f%2fgraph.windows.net&client_id=[clientId]&client_secret=[urlencoded client secret]

```

I get back a token from this request and then attempt to query the federated directory from the graphapi again with fiddler:

Action Method: GET

URL: <https://graph.windows.net/[federated> domain]/directoryObjects/{group-guid}

Header Block:

```
Content-Type: application/json
Host: graph.windows.net
Authorization: Bearer [token from login response]

```

I receive and 403 response with the body:

```
{"odata.error":{"code":"Authorization_RequestDenied","message":{"lang":"en","value":"Insufficient privileges to complete the operation."}}}

```

In Azure Active Directory, Under App Registrations for this application the manifest has been modified by a user with Company Admin Role for:

```
"groupMembershipClaims": "SecurityGroup", ...
"oauth2AllowImplicitFlow": true, 

```

An Application Key was generated that is used for fetching a token to access the graph API.
Under Required Permissions for Application Permissions Read directory data, and Read all hidden memberships were checked by a user with Company Admin Role.

I'm out of ideas everything should be working.