title: Microsoft Graph accessing through custom login
body: <p>I have a standard Microsoft Graph code sample that does the following:</p>
  
  <pre><code>AuthenticationContext authContext = new AuthenticationContext(SettingsHelper.AzureADAuthority);            
  string redirectUri = Url.Action("EmployeeAuthorize", "Account", null, Request.Url.Scheme);
  Uri authUri = authContext.GetAuthorizationRequestURL(SettingsHelper.O365UnifiedResource, SettingsHelper.ClientId, new Uri(redirectUri), UserIdentifier.AnyUser, null);
  return Redirect(authUri.ToString());
  </code></pre>
  
  <p>This brings up the Microsoft login page that I have customized as much as I can and goes through Azure AD and I can access the unified graph API either Azure AD or SharePoint, one drive for business etc... </p>
  
  <p>The problem is that executives don't like the login experience at all, even though they love access to office365 via the unified graph api, and I am asking how I can create a custom experience with the following criteria:</p>
  
  <ol>
  <li>no tenant requirements - ie. login name can be foo@azure_AD_tenant.com or foo@gmail.com or foo@outlook.com. Currently Azure AD requires a tenant name or "live id" subscription, and I can't have restrictions on the login name as we want clients or even casual guests to access some of our content via shared files through roles.</li>
  <li>ability to create roles for the login account that can be anything we want like admin, premium client, guest etc...</li>
  <li>access to the unified graph api...like office 365 shared files or yammer conversations, groups etc...</li>
  <li>login UI must be 100% customizable - ie. no redirect to a Microsoft login page experience, but our own experience. It is understood this could mean keeping passwords and adding multi-authentication on our own.</li>
  </ol>
  
  <p>Basically 100% custom login experience and a token to access to Graph API.</p>
  
  <p>One possible solution might be:</p>
  
  <p>Scenario:
  1. User creates an account through our UI only (foo@outlook.com / mypassword), and we hold that in a database\service fabric. This allows us to create our own roles.
  2. Upon account creation, we create an azure AD account (api\powershell) for foo_outlook@tenant.com. This could satisfy the Azure AD Tenant requirement in the login name.
  3. When the user logins in again, we access Azure AD with foo_outlook@tenant.com\mypassword. But this requires an API for the graph API where I can use username &amp; password to get a token and I'm not sure this exists? </p>
  
  <p>I also need 3rd party identities, but that feature is not available yet. </p>
  
  <p>But can I at least create my own 100% personal login experience and get a token for access to the graph API?</p>
  
  <p>thanks
  Rob</p>