Quickstart: .NET console app that accesses a protected web API

  • Article

This quickstart uses a sample .NET console application to access a protected web API as its own identity by using the Microsoft Authentication Library (MSAL) for .NET. The application is a daemon application, which is a confidential client application, and uses the client credentials OAuth flow to get an access token to call the Microsoft Graph API.

Prerequisites

Register the application and record identifiers

To complete registration, provide the application a name and specify the supported account types. Once registered, the application Overview pane displays the identifiers needed in the application source code.

  1. Sign in to the Microsoft Entra admin center.

  2. If you have access to multiple tenants, use the Settings icon in the top menu to switch to the tenant in which you want to register the application from the Directories + subscriptions menu.

  3. Browse to Identity > Applications > App registrations, select New registration.

  4. Enter a Name for the application, such as identity-client-daemon-app.

  5. For Supported account types, select Accounts in this organizational directory only. For information on different account types, select the Help me choose option.

  6. Select Register.

    Screenshot that shows how to enter a name and select the account type in the Microsoft Entra admin center.

  7. The application's Overview pane is displayed when registration is complete. Record the Directory (tenant) ID, the Application (client) ID and Object ID to be used in your application source code.

    Screenshot that shows the identifier values on the overview page on the Microsoft Entra admin center.

    Note

    The Supported account types can be changed by referring to Modify the accounts supported by an application.

Create a client secret

  1. In the Microsoft Entra admin center, browse to Identity > Applications > App registrations.
  2. Select the application that you registered earlier.
  3. In the application's Overview pane, select Certificates & secrets > New client secret.
  4. Enter a description for the secret in the Description field.
  5. Select an expiration period for the secret.
  6. Select Add.
  7. Record the Value of the client secret. The value is displayed only once, so make sure to record it.

Clone or download the sample application

To obtain the sample application, you can either clone it from GitHub or download it as a .zip file.

  • To clone the sample, open a command prompt and navigate to where you wish to create the project, and enter the following command:

    git clone https://github.com/Azure-Samples/ms-identity-docs-code-dotnet.git

  • Download the .zip file. Extract it to a file path where the length of the name is fewer than 260 characters.

Configure the project

  1. In your IDE, open the project folder, ms-identity-docs-code-dotnet/console-daemon, containing the sample.

  2. Open Program.cs and replace the file contents with the following snippet;

     // Full directory URL, in the form of https://login.partner.microsoftonline.cn/<tenant_id>
 Authority = " https://login.partner.microsoftonline.cn/Enter_the_tenant_ID_obtained_from_the_Microsoft_Entra_admin_center",
 // 'Enter the client ID obtained from the Microsoft Entra Admin Center
 ClientId = "Enter the client ID obtained from the Microsoft Entra admin center",
 // Client secret 'Value' (not its ID) from 'Client secrets' in the Microsoft Entra Admin Center
 ClientSecret = "Enter the client secret value obtained from the Microsoft Entra admin center",
 // Client 'Object ID' of app registration in Microsoft Entra Admin Center - this value is a GUID
 ClientObjectId = "Enter the client Object ID obtained from the Microsoft Entra admin center"
    • Authority - The authority is a URL that indicates a directory that MSAL can request tokens from. Replace Enter_the_tenant_ID with the Directory (tenant) ID value that was recorded earlier.
    • ClientId - The identifier of the application, also referred to as the client. Replace the text in quotes with the Application (client) ID value that was recorded earlier from the overview page of the registered application.
    • ClientSecret - The client secret created for the application in the Microsoft Entra admin center. Enter the value of the client secret.
    • ClientObjectId - The object ID of the client application. Replace the text in quotes with the Object ID value that was recorded earlier from the overview page of the registered application.

Run the application

  1. In a terminal, navigate to the project directory, ms-identity-docs-code-dotnet/console-daemon.

  2. Run the following command to build and run the application:

    dotnet run

  3. The application runs and displays a response similar to the following (shortened for brevity):

    {
"@odata.context": "https://microsoftgraph.chinacloudapi.cn/v1.0/$metadata#applications/$entity",
"id": "00001111-aaaa-2222-bbbb-3333cccc4444",
"deletedDateTime": null,
"appId": "00001111-aaaa-2222-bbbb-3333cccc4444",
"applicationTemplateId": null,
"disabledByMicrosoftStatus": null,
"createdDateTime": "2021-01-17T15:30:55Z",
"displayName": "identity-dotnet-console-app",
"description": null,
"groupMembershipClaims": null,
...
}

Related content