Where does MS Graph get the user information from when I run "https://graph.microsoft.com/v1.0/me/"? I have entered mobile phone in my profile in both Azure AD and Office 365, but it still wont show up when I run /me.
How do I get the Azure AD user´s role, after a successful Azure AD login? Must I have a Premium paying account to get it?
I can use https://graph.microsoft.com/v1.0/me?$select=mobilePhone to get the mobile phone.
Please have a try with it.
For how to get the Azure AD user's role, please refer to List memberOf.
You will get a response like this:
.
"Company Administrator" means the role of the user is Global Admin.
Related
Is there a way to find out if email address belongs to Azure Ad instance?
I have a list of email addresses of my customers and I have to figure out if they have azure ad instance.
I tried to reproduce the same in my environment and got the results like below:
To check if the User Emails belongs to the Azure AD Tenant, you can make use of PowerShell like below:
Connect-AzureAD
Get-AzureADUser -ObjectId User#XXX.onmicrosoft.com
If the User belongs to the connected Azure AD Tenant, then the user details will be retrieved otherwise it will throw an error like below:
You can also make use of the authorize endpoint to check if the user resides in the Azure AD Tenant.
For sample, when I use the below endpoint I get a sign-in screen.
https://login.microsoftonline.com/TenantID/oauth2/v2.0/authorize?
&client_id=ClientID
&response_type=code
&redirect_uri=https://jwt.ms
&response_mode=query
&scope=user.read
&state=12345
When I enter the user not belonging to the Azure AD Tenant, I get the below error:
If the User belongs to the Azure AD Tenant, then I get the redirect screen successfully like below:
Alternatively, you can also make use of Microsoft Graph API like below:
https://graph.microsoft.com/v1.0/users/user#xxx.onmicrosoft.com
For more in detail, refer below links:
Verify if user account exists in Azure Active Directory by Rohit Saigal
Check if an user is member of some Azure Active Directory Tenant by astaykov
I have web app which implements Azure AD sign in for authentication. After authenticating user with the help of Microsoft Graph I grab few details like email of the user and then look for user in my database.
The problem is, lets say the user gets authenticated in Azure AD account but the email is not present in database. In that case I want when user again try to authenticate then Sign in page by azure should be showed again.
On guest user login on redirect URI I got an error:
AADSTS1000031: Application {App name} cannot be accessed at this time. Contact your administrator.
I'm using multi-tenant approach. The authorization URL looks good and it redirects me with such an error.
But I can't find any description of the error or configuration in the azure related to this error.
Also, "normal" users can log in without any issues.
I have such configuration in my Azure App:
Could you please advise how can I enable guest accounts support here?
This error can occur if you have not granted admin consent.
Go to Azure Active Directory within the Azure portal.
Go to Application registrations.
Select the Application based on the App-Id.
Go to API Permissions.
Click Grant Admin consent.
https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/grant-admin-consent
Has this SSO been setup as an Enterprise application?
Or are you just trying to get a guest user logged in to your tenancy as a guest?
If it is the later just create a new Guest user within your tenancy, make sure you have the rights to to do this first.
Then have the guest user accept the email invitation they receive.
Confirm within Azure they have accepted the invite.
Also make sure they are using the same email address as the invite was sent to and not an alias, which can cause confusion.
We're getting a 400 error with the message "Tenant does not have a SPO license" when we try to access the Sharepoint-endpoints in the Microsoft Graph v1.0 API.
We've registered our Azure AD app and assigned Application Permissions (as opposed to Delegated) for the relevant endpoints, as we need to access the endpoints server to server (ie. outside the context of an authenticated user).
The tenant is connected to an Office 365 Business subscription, that we can assign to users, but the tenant in this case is the directory itself and we don't see how we can assign a subscription to that.
It seems there is precious little information available regarding this, and most of it applies to the delegated permissions scenario.
Any help would be greatly appreciated.
If you have purchased an O365 Business subscription, you may still need to be assign SPO (SharePoint Online) license for specific AAD user/ O365 user.
Use your admin account to log into O365 admin center and select a user and assign SPO license.
After clicking on "Edit", you can choose a SharePoint license to assign it to the user.
When I log onto the Microsoft Graph Explorer with my Microsoft account and run the following query https://graph.microsoft.com/v1.0/users/ I get the correct user returned.
On Azure AD (using the same login) I created an application with a key and when I sign in through c# using Microsoft.IdentityModel.Clients.ActiveDirectory.ClientCredentials with a token for resource https://graph.microsoft.com and run the same query I get a completely different user. They are out of sync and I'm baffled.
Any ideas? Should I create a new Azure account as I've had the Azure account from day 1 and I'm only doing this now to test for a client request.
Don't create a new Azure account. When you are using Graph Explorer, are you signed in with a user from your Azure AD tenant? If not, Graph Explorer will default to use a demo tenant for your queries.
Also (if you have more than one tenant) you need to make sure that you select the correct tenant as part of the token acquisition (from https://login.microsoftonline.com/{tenantId | tenantDomain}. If you want the results to match between Graph Explorer and your app, the tenant the signed-in user belongs to (for Graph Explorer case) and the tenant used by your app needs to be the same.
UPDATE based on comment below:
I think I know what's going on here. In graph explorer, you are signing in with your personal account - and it's showing you profile data of that personal account, including the unique ID for this account in the Microsoft Account system. In this case you aren't signing into an Azure AD tenant at all. Microsoft Graph supports access from both personal and commercial accounts.
Now, additionally, I'm guessing when you signed up for an Azure subscription, you used this personal account. When you do that, it creates an Azure AD tenant, and creates a guest user in that tenant that is (linked to) your personal account - this account is also configured as an admin account. This mechanism allows you to sign in with your personal account (authenticated by the Microsoft Account system) into an Azure AD tenant, because the personal account maps to this guest user in your tenant. In your application, you are getting an app token to your Azure AD tenant. When you query the tenant for users, you don't see any user with the same id or email address as you did with graph explorer. However if you actually look at the userPrincipalName, you'll see it should be a mangled form of the original email address of your personal account. This indicates that this Azure AD user account in your tenant is a guest/external user (similar to a foreign principal).
Hope this helps,