title: Accessing Microsoft Graph with AAD App
body: <p>I begin with my question. How do I read data from my AAD using Microsoft Graph using an app registration perfomed inside of an Azure AD? Now the details...</p>
  
  <p>I have created an app registration in my Azure Active Directory and allowed access to Microsoft Graph there:</p>
  
  <p><a href="https://i.stack.imgur.com/2RxEh.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/2RxEh.png" alt="AAD portal with required permissions"></a></p>
  
  <p>To be exact the app has the following permissions:</p>
  
  <ul>
  <li>Application Permissions
  
  <ul>
  <li>Read all users' relevant people lists and search the directory</li>
  <li>Read all users' full profiles</li>
  </ul></li>
  <li>Delegated Permissions
  (None)</li>
  </ul>
  
  <p>I use the following code in my ASP.NET MVC app to authenticate my website against the AAD:</p>
  
  <pre><code>public void SignIn()
  {
      if (!Request.IsAuthenticated)
      {
          HttpContext.GetOwinContext().Authentication.Challenge(
              new AuthenticationProperties
              {
                  RedirectUri = "/"
              },
              OpenIdConnectAuthenticationDefaults.AuthenticationType);
      }
  }
  </code></pre>
  
  <p>which is pretty much the default setting for doing organizational auth. This works and I even can read out my users informations from the AAD profile:</p>
  
  <pre><code>private string GetUserName()
  {                        
      var claimsPrincipal = ClaimsPrincipal.Current;           
      var firstName = claimsPrincipal.FindFirst(ClaimTypes.GivenName).Value;
      var lastName = claimsPrincipal.FindFirst(ClaimTypes.Surname).Value;
      return $"{firstName} {lastName}";
  }
  </code></pre>
  
  <p>Now I try to use Microsoft Graph to optain lets say the avatar image. There are some official MS samples available <a href="https://github.com/search?q=aspnet%20sample%20user:microsoftgraph&amp;type=Repositories" rel="nofollow noreferrer">here</a>. But all of them rely on a NuGet package called <code>Microsoft.Identity.Client</code> which is preview currently. The other thing is that MS wants me to register my app under <a href="https://apps.dev.microsoft.com/" rel="nofollow noreferrer">Application Registration Portal</a> which makes no sense to me because I already have an registered app.</p>
  
  <p>I already tries to retrieve my bearer token from my claims identity and use it in Graph like this:</p>
  
  <pre><code>var ci = (System.Security.Claims.ClaimsIdentity)ClaimsPrincipal.Current.Identity;
  var token = ((System.IdentityModel.Tokens.BootstrapContext)ci.BootstrapContext).Token;
  var endpoint = "https://graph.microsoft.com/v1.0/me/photo/$value";
  using (var client = new HttpClient())
  {
      using (var request = new HttpRequestMessage(HttpMethod.Get, endpoint))
      {                    
          request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
          var response = await client.SendAsync(request);                 
          if (response.IsSuccessStatusCode)
          {
              return await response.Content.ReadAsStreamAsync();
          }                    
      }
  }
  return null;
  </code></pre>
  
  <p>But this gives my 401.</p>