Azure AD has a maximum number of groups that can be returned in an access token when you have selected to include the groups claim for your access token. This post will show you how to reproduce the scenario and then how to get the users groups using Microsoft Graph when a groups overage claim is present in the token instead of actual groups. For a JWT token, Azure has…
Read MoreHow to perform logging for both MSAL.Net and Microsoft Graph SDK
Microsoft Graph SDK has the ability to log out complete HTTP Requests and Reponses as documented here. The way this logging mechanism works is by implementing a custom HttpClient Message handler to intercept every HTTP Request and Response between the client application and the Microsoft Graph Service. Besides hooking into GraphServiceClient’s processing pipeline to do request and response tracing, one can also configure proxy info. See Customize the Microsoft Graph…
Read MoreHow to avoid the MS Graph error “Authorization_RequestDenied” while managing users
Problem: You may see the error “Authorizaion_RequestDenied” below ‘error’: { ‘code’: ‘Authorization_RequestDenied’, ‘message’: ‘Insufficient privileges to complete the operation.’, ‘innerError’: { ‘date’: ‘2020-11-09T20:28:42’, ‘request-id’: ‘604e410b-4af8-4b79-9f48-fe0cf905a759’, ‘client-request-id’: ‘d6350bb5-3660-1f44-01a8-8a3b86a4c12a’ } } when using Microsoft Graph to manage users. The error happens most likely because the user does not have sufficient permissions. In summary the call requires both of the following: 1) The user or application needs to be in an Administrative role2)…
Read MoreAzure AD-protected Web API using Spring Boot Starter for Azure Active Directory
In this blog post, I will demonstrate a simple Azure AD-protected Web API sample using Spring Boot Starter for Azure Active Directory. If you are not familiar with Spring Boot Starter for Azure Active Directory, please take a look at azure-sdk-for-java/sdk/spring/azure-spring-boot-starter-active-directory at main · Azure/azure-sdk-for-java (github.com) and the Azure AD Spring Developer’s Guide. Requirement: You must have a Web API Application registered in Azure Active Directory and expose its permission…
Read MoreScript errors running MSAL.Net in XBAP application
You may encounter script errors with the background text saying cookies are disabled when running MSAL code snippet similar to the following in a XAML Browser Application (XBAP) from Internet Explorer when performing Azure AD login Root Cause XBAP Applications, although housed in Internet Explorer, runs in its own process space: PresentationHost.exe, which is a very tightly-controlled security container. XBAP Application uses the webBrowser control to host the Azure AD…
Read MoreHow to use an access token to connect to an Azure SQL Database
In Azure SQL, an access token can be used to authenticate a user or service principal. In this blog post, I will show you what is required for both and give some methods for acquiring the access token based on the scenario to set the access token parameter in the connection object. Requirements: You have an Azure tenant and an Azure SQL database already configured and basic understanding of SSMS…
Read MoreUpdate Asp.Net or Asp.Net Core app session to last longer than Azure AD tokens
Azure AD tokens (ID tokens, access tokens, and SAML tokens) by default last one hour. Asp.Net and Asp.Net Core Middleware sets their authentication ticket to the expiration of these tokens by default. If you do not want your web application to kick the user out redirecting them to Azure AD to sign-in again, you can customize the Middleware authentication ticket. For Asp.Net… In most cases within your Startup.Auth.cs under ConfigureAuth,…
Read MoreUsing MSAL in a VB.Net Winforms application
All of our MSAL samples are for either Web, mobile client or console applications in c#. This blog post will show how you can also use MSAL in vb.net in a Winforms desktop application. When creating a winforms application, the thing to remember is that code in your form will run under the UI thread, which, for the most part is ok. However, when MSAL prompts for credentials, it will…
Read MoreNetLog: Alternative to Fiddler and HAR captures
Have you run across where you can’t get a standard Fiddler capture, and furthermore, HAR captures from developer tools is truncating the information you need to see? I ran across the NetLog tool built into Chromium based browsers. So, this will work in the new Microsoft Edge, Chrome, and Electron. Here are couple known limitations before we get started… POST request bodies are not captured. Sites running in compatibility mode…
Read MoreReceiving error ‘Neither tenant is B2C or tenant doesn’t have premium license’ from Microsoft Graph
You may receive the following error ‘error’: { ‘code’: ‘Authentication_RequestFromNonPremiumTenantOrB2CTenant’, ‘message’: ‘Neither tenant is B2C or tenant doesn’t have premium license’, ‘innerError’: { ‘date’: ‘2021-03-04T07:53:51’, ‘request-id’: ‘a0a074e6-xxx-c511669fa420’, ‘client-request-id’: ‘a0a074e6-xxx-c511669fa420′ } when making any Microsoft Graph call querying users’ sign in activities, for example the following GET requests https://graph.microsoft.com/v1.0/auditLogs/signIns or https://graph.microsoft.com/beta/users?$select=displayName,userPrincipalName,signInActivity So what’s the resolution? The following criteria are required for the call to succeed: The queried tenant or directory will…
Read More