title: What are the permission needed for a ServicePrincipal to call getObjectsByObjectIds?
body: <p>What are the permission needed for an Service Principal to call AD graph API: Get Objects By Object Ids:</p>
  
  <p>POST <a href="https://graph.windows.net/" rel="nofollow noreferrer">https://graph.windows.net/</a>{tenantID}/getObjectsByObjectIds?api-version=1.6</p>
  
  <p>I set up an App with </p>
  
  <p>Application Permission: Read directory data.</p>
  
  <p>Delegated Permission: </p>
  
  <p>Read Directory data
  Read and write directory data
  Read all users full profile
  Sign in and read user profile.</p>
  
  <p>But I am receiving Forbidden ( status code 403) while making the API call:</p>
  
  <p><a href="https://i.stack.imgur.com/MFkQR.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/MFkQR.png" alt="enter image description here"></a></p>
  
  <p>Also i got access token through this code:</p>
  
  <p>string authority = "<a href="https://login.microsoftonline.com/" rel="nofollow noreferrer">https://login.microsoftonline.com/</a>" + "microsoft.com";</p>
  
  <pre><code>        AuthenticationContext ac = new AuthenticationContext(authority);
  
          ClientCredential cr = new ClientCredential("Appid", "Cred");
          string OfficeUrl = "https://graph.windows.net";
          AuthenticationResult authenticationResult = ac.AcquireTokenAsync(OfficeUrl, cr).Result;
          string token = authenticationResult.AccessToken;
          // string token = this.SetAuthorizationToken();           
          client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token);
  </code></pre>