Share via

Unable to call graphAPI using On-behalf-of flow from Asp.Net Web API

Trupti Satardekar 1 Reputation point
2021-05-27T14:40:18.347+00:00

Hello Support Team,

I am really stuck at a problem since last week, I have already described the problem on stackoverflow, below is the link

https://stackoverflow.com/questions/67724384/unable-to-call-graphapi-using-on-behalf-of-flow-from-asp-net-web-api

However, if you need any more information, I could provide.

Thank you,
Trupti Satardekar

C#
C#
An object-oriented and type-safe programming language that has its roots in the C family of languages and includes support for component-oriented programming.
10,352 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
19,769 questions

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Hazem Elshabini 81 Reputation points
    2021-05-31T09:30:25.687+00:00

    I assume you are talking about Azure AD B2C. If that's the case, this functionality simply does not exist in Azure AD B2C.

    For your application to be able to call the graph API on behalf of the user, it needs to have delegated permissions to the graph API. If you check the App Registration > API Permissions blade in Azure AD B2C, you'll see that you are unable to delegate any other scopes other than "offlice_access" and "open_id".
    101007-screen-shot-2021-05-31-at-111803-am.png

    In order for your app to call the graph API, you'll need to use Application Permissions instead, where your app will manually authenticate to Graph with its own identity, and perform the request API operations not on behalf of the logged in user. Such example can be found manage-b2c-users-dotnet-core-ms-graph

  2. Hazem Elshabini 81 Reputation points
    2022-05-31T14:38:35.003+00:00

    The OnBehalfOf Flow is not supported yet in B2C, which is why your scenario doesn't work. As a workaround, user can use "ProfileEdit" flows to edit their information. If a much more involved edit is needed, your only option for now is to build your own app/api which authenticates with an application identity to make those Graph API calls. Again, not on behalf of the user but instead represented by the application identity itself.