While using Microsoft Graph explorer, you accidentally consented to permission(s) that you did not mean to. This blog post will explain how to unconsent or remove that permission(s). Log in to graph explorer (Graph Explorer | Try Microsoft Graph APIs – Microsoft Graph) with your credentials. Note: In order to perform the following unconsent steps, make sure these permissions: Directory.Read.All and DelegatedPermissionGrant.ReadWrite.All are already consented. Perform the following steps to…
Read MoreMicrosoft.Identity.Client.MsalClientException: Failed to get user name
You might be using the following method to attempt Integrated Windows Auth while using Microsoft Authentication Library (MSAL)… and you are getting one of the following errors… Make sure you at least meet these minimum requirements: What is actually failing? MSAL makes a call to GetUserNameEx function from secur32.dll… https://github.com/AzureAD/microsoft-authentication-library-for-dotnet/blob/01ecd12464007fc1988b6a127aa0b1b980bca1ed/src/client/Microsoft.Identity.Client/Platforms/Features/DesktopOS/WindowsNativeMethods.cs#L66 For more information about GetUserNameEx… https://learn.microsoft.com/en-us/windows/win32/api/secext/nf-secext-getusernameexa Windows is returning this error message. There is a number of reasons this can…
Read MoreHow to resolve “No account or login hint was passed to the AcquireTokenSilent” with a Web App and no persistent token cache
You have implemented Microsoft Authentication Library or Microsoft Identity Web and now you are seeing the following error message: No account or login hint was passed to the AcquireTokenSilent The root cause is because the Token Cache is empty when you are trying to acquire a token silently when account was attempted to be pulled from MSAL. So on Web Applications like Asp.Net or Asp.Net Core, this is generally when…
Read MoreThe identity of the calling application could not be established
You are getting the following error from Microsoft Graph or downstream services that uses Microsoft Graph… The identity of the calling application could not be established This error is thrown because the “oid” and “sub” claim is missing from the access token. This is because the servicePrincipal does not exist in the tenant or the tenant is not aware of the application. Partner Scenario If this is a Partner application,…
Read MoreHow to Resolve IDX10501 Errors in a B2C Microsoft.Identity.Web Application
Consider the situation where you are developing an ASP.NET Core application that needs to support Azure B2C. Following the official Microsoft Document, you implement the Microsoft.Identity.Web library and three built-in User Flows. All is working well, but you also need to implement a Custom Policy. You find the following documentation which shows how to make a request with the B2C policy specified: https://learn.microsoft.com/en-us/azure/active-directory-b2c/enable-authentication-web-application-options#pass-the-azure-ad-b2c-policy-id You try to implement this guidance. Everything…
Read MoreUse logging to troubleshoot Azure AD protected Web API Authentication or Authorization errors
The sample web API application in this blog uses .Net 6 Framework and Microsoft.Identity.Web nuget package to Azure AD protect the Web API. I use Serilog framework for logging the debug output both to the console window and to the local file. This sample assumes you already have a web API application registered in Azure AD. If you are not familiar with how to do that refer to my previous…
Read MoreManaging Microsoft Graph requests in Microsoft Graph PowerShell
Basics of using Microsoft (MS) Graph PowerShell to update objects using Hashtables and JSON. These are just some examples that could be used. By no means would I consider these the “best” way to handle each scenario, however, this should get you started in the right direction. In general, a good thing to keep in mind, a Microsoft Graph type could be resembled as a PowerShell Hashtable or Array. To…
Read MoreMaking MS Graph Requests using Managed Identities
This blog post is an extension to my previous post about how to get secrets and access tokens using Managed Identities with VB.Net and C#. You can read that post here. There is a c# sample for this particular blog here. The scenario here is that you already have the code to use the managed identities and now you want to get an access token for a resource that requires…
Read MoreUsing Azure Identity Client with VB.Net or C# to get a KeyVault secret
This blog post will show you how to use the Azure Identity Client library in VB.Net and C# to use a Managed Identity to access a secret in KeyVault. This is assuming that you already have a keyVault secret and the user has the proper access policy to read a keyvault secret. This post will not show you how to do those tasks, only how to implement the Azure Identity…
Read MoreUsing Microsoft Graph PowerShell SDK to manage user consented permissions
The oAuth2PermissionGrant object keeps a record of user consented permissions (Delegated Permissions) in a tenant. There is one OAuth2PermissionGrant object (identified by Consent ID) for each combination of client application, resource application, and user. The sample PowerShell script in this post will perform the following tasks: Remove all MS Graph Delegated permissions (if any) for the user Perform user consent for an initial set of MS Graph permission Update the…
Read More