title: Call Microsoft Graph API Using Azure AD 1.0 Endpoint Client Credentials Flow
body: <p>Is it possible to access the Microsoft Graph API using an access token obtained through the Azure Active Directory 1.0 Endpoint with the Client Credentials OAuth 2 flow?</p>
  
  <p>For example:</p>
  
  <pre><code>POST https://login.microsoftonline.com/{mytenant}.onmicrosoft.com/oauth2/token
  grant_type=client_credentials,
  client_id={app id registered in azure portal},
  client_secret={registered app key},
  resource=https://graph.microsoft.com
  </code></pre>
  
  <p>When I use the token returned from this request, I get the following error trying to call <a href="https://graph.microsoft.com/v1.0/groups" rel="nofollow noreferrer">https://graph.microsoft.com/v1.0/groups</a>.</p>
  
  <p>Decoded JWT</p>
  
  <p>Header</p>
  
  <pre><code>{
    "typ": "JWT",
    "alg": "RS256",
    "x5t": "HHByKU-0DqAqMZh6ZFPd2VWaOtg",
    "kid": "HHByKU-0DqAqMZh6ZFPd2VWaOtg"
  }
  </code></pre>
  
  <p>Payload</p>
  
  <pre><code>{
    "aud": "00000002-0000-0000-c000-000000000000",
    "iss": "https://sts.windows.net/{tenant id}/",
    "iat": 1504804880,
    "nbf": 1504804880,
    "exp": 1504808780,
    "aio": "Y2FgYDiiO8/s3smXRdxLg87zBPRNAwA=",
    "appid": "{client id}",
    "appidacr": "1",
    "idp": "https://sts.windows.net/{tenant id}/",
    "oid": "{enterprise app object id}",
    "sub": "{enterprise app object id}",
    "tenant_region_scope": "NA",
    "tid": "{tenant id}",
    "uti": "uIzrJNpHcEGXoQ4ZKZgqAA",
    "ver": "1.0"
  }
  
  {
    "error": {
      "code": "InvalidAuthenticationToken",
      "message": "Access token validation failure.",
      "innerError": {
        "request-id": "3537d28e-a061-4430-aef5-4a75bf791d90",
        "date": "2017-09-07T16:38:26"
      }
    }
  }
  </code></pre>
  
  <p>I've ensured the application has the correct permissions assigned through the portal.  Under Required Permissions > Application Permissions, "Read and write all groups" is selected.</p>
  
  <p><a href="https://i.stack.imgur.com/3Tzyo.png" rel="nofollow noreferrer">Azure Portal Permissions</a></p>
  
  <p>Is there anything I'm missing or is this not possible?</p>