title: ActiveDirectoryClient 2.0 - Insufficient privileges to complete the operation
body: <p>Hello: I am trying to convert a project to use the newer ActiveDirectoryClient. I've done this a few times with the Graph 1 client and the older Azure Portal but I am running into an "insufficient privileges" error. </p>
  
  <p>A few questions:</p>
  
  <ol>
  <li>I went in and gave my app "application permissions" and am using a client id and secret. I added the Microsoft Graph API, "Read all users' full profiles" and "Read directory Data". I also added the Windows Azure Active Directory, "Read directory data." These state they require admin consent "Requires Admin" (but are checked in the portal). My API calls require a clientid so how do I grant that consent?</li>
  <li>My code to connect and get users is included below. I notice that the code running in the GetToken method is running after the line "return client.Users.Where(..." which makes me concerned that the call to get the users (where the exception is thrown) is being called without a valid auth token. I would've figured await would handle that. This seems to happen with version 2 or 3 of the ADAL library. All of the examples appear to use similar syntax however. Is there a way to view the token ahead of the query to ensure it is being set properly? </li>
  </ol>
  
  <p>Thank you!</p>
  
  <pre><code>public IUser FindUser(string username)
  {
      var client = GetClient();
      if (client != null)
      {
          return client.Users.Where(x =&gt; x.UserPrincipalName == username).ExecuteSingleAsync().Result;
      }
      else
      {
          return null;
      }
  }
  
  
  private static ActiveDirectoryClient GetClient()
  {
      try
      {
          Uri servicePointUri = new Uri(_graphName);
          Uri serviceRoot = new Uri(servicePointUri, _tenantName);
  
          var client = new ActiveDirectoryClient(serviceRoot, async () =&gt; { return await GetToken(servicePointUri); });
  
          return client;
      }
  
      catch (Exception ex) {
          return null;
      }
  
  }
  
  private static async Task&lt;string&gt; GetToken(Uri servicePointUri)
  {
      var authenticationContext = new AuthenticationContext(_authString, false);
      var credentials = new ClientCredential(_clientId, _clientSecret);
      var result = authenticationContext.AcquireToken(servicePointUri.ToString(), credentials);
      return result.AccessToken;
  
  }
  </code></pre>