Calling Microsoft Graph API from inside Azure Functions

Question

I\'m trying to write a simple Azure Function that calls the Microsoft Graph API. But I could not make the access_token work. Here is what I\'ve done:

1. Created a

Answer 1

There are two ways you can make this work when using Azure App Service Authentication / Authorization:

1. Assign a default resource in your function app's AAD configuration.
2. Use the AAD on-behalf-of flow to exchange your ID token (x-ms-token-aad-id-token) for an MS Graph access token.

The simplest approach which doesn't require any code changes is to do #1. I outline the process in my App Service Auth and the Azure AD Graph API blog post (which needs some updates), but I'll give you the Functions-optimized version for the Microsoft Graph here.

The main things you need to do are:

1. Ensure your AAD settings include a client-secret (you already have this).
2. Ensure your AAD settings have the permissions to access the Microsoft Graph (you have already done this).
3. Open your function app in Resource Explorer (use the link in the portal under Platform Settings), navigate to config/authsettings on the left-hand panel, change "additionalLoginParams" from null to ["resource=https://graph.microsoft.com"], and save the changes.

After doing this and logging in again, the x-ms-token-aad-access-token request header will always give you an access token that works with the Microsoft Graph.

The disadvantage of the above approach is that it doesn't help you if you need to access more than one AAD-protected resource from your function app. If that's a problem for you, then you'll need to use approach #2 above.