title: MS Graph API - Get access without a user - Verifying MS response
body: <p>When using MS-Graph oauth flow <a href="https://docs.microsoft.com/en-us/graph/auth-v2-service" rel="nofollow noreferrer">&quot;Get Access without a user&quot;</a>, Microsoft responds with a GET request of the following structure (from the example in the linked page):</p>
  <pre><code>GET https://localhost/myapp/permissions
  ?tenant=a8990e1f-ff32-408a-9f8e-78d3b9139b95
  &amp;state=12345
  &amp;admin_consent=True
  </code></pre>
  <p>Is there anyway to verify that the response came from Microsoft?</p>
  <p>In our application we're using the <code>state</code> to link an internal tenant-id with the Microsoft tenant-id. If the above response can be forged, an adversary may link his own tenant-id to the victim's Microsoft tenant-id.</p>