Quickstart: Call a web API in a sample daemon app

• A minimum requirement of .NET 6.0 SDK.
• Visual Studio 2022 or Visual Studio Code.

• Node.js.
• Visual Studio Code or another code editor.

• Python 3+.
• Visual Studio Code or another code editor.

• Java Development Kit (JDK) 8 or later.
• Maven.
• A suitable code editor.

For the .NET daemon app, you don't need to grant and consent to any permission. This daemon app reads its own app registration information, so it can do so without being granted any application permissions.

1. From the App registrations page, select the application that you created, such as ciam-client-app.

2. Under Manage, select API permissions.

3. Under Configured permissions, select Add a permission.

4. Under Microsoft APIs tab, select the Microsoft Graph >> Application permissions. We select the Application permissions option as the app signs in as itself, but not on behalf of a user.

5. In the Select permissions list, search for then select User.Read.All. We grant this permission so the app wants can read all users' full profiles.

6. Select the Add permissions button.

7. At this point, you've assigned the permissions correctly. However, since the daemon app doesn't allow users to interact with it, the users themselves can't consent to these permissions. You as the tenant administrator must consent to these permissions on behalf of all the users in the tenant:

   1. Select Grant admin consent for <your tenant name>, then select Yes.
   2. Select Refresh, then verify that Granted for <your tenant name> appears under Status for both permissions.

1. From the App registrations page, select the application that you created, such as ciam-client-app.

2. Under Manage, select API permissions.

3. Under Configured permissions, select Add a permission.

4. Under Microsoft APIs tab, select the Microsoft Graph >> Application permissions. We select the Application permissions option as the app signs in as itself, but not on behalf of a user.

5. In the Select permissions list, search for then select User.Read.All. We grant this permission so the app wants can read all users' full profiles.

6. Select the Add permissions button.

7. At this point, you've assigned the permissions correctly. However, since the daemon app doesn't allow users to interact with it, the users themselves can't consent to these permissions. You as the tenant administrator must consent to these permissions on behalf of all the users in the tenant:

   1. Select Grant admin consent for <your tenant name>, then select Yes.
   2. Select Refresh, then verify that Granted for <your tenant name> appears under Status for both permissions.

1. From the App registrations page, select the application that you created, such as ciam-client-app.

2. Under Manage, select API permissions.

3. Under Configured permissions, select Add a permission.

4. Under Microsoft APIs tab, select the Microsoft Graph >> Application permissions. We select the Application permissions option as the app signs in as itself, but not on behalf of a user.

5. In the Select permissions list, search for then select User.Read.All. We grant this permission so the app wants can read all users' full profiles.

6. Select the Add permissions button.

7. At this point, you've assigned the permissions correctly. However, since the daemon app doesn't allow users to interact with it, the users themselves can't consent to these permissions. You as the tenant administrator must consent to these permissions on behalf of all the users in the tenant:

   1. Select Grant admin consent for <your tenant name>, then select Yes.
   2. Select Refresh, then verify that Granted for <your tenant name> appears under Status for both permissions.

git clone https://github.com/Azure-Samples/ms-identity-docs-code-dotnet.git

• Download the .zip file. Extract it to a file path where the length of the name is fewer than 260 characters.

git clone https://github.com/azure-samples/ms-identity-javascript-nodejs-console.git 

• Download the .zip file. Extract it to a file path where the length of the name is fewer than 260 characters.

git clone https://github.com/Azure-Samples/ms-identity-python-daemon.git 

• Download the .zip file. Extract it to a file path where the length of the name is fewer than 260 characters.

git clone https://github.com/Azure-Samples/ms-identity-java-daemon.git

• Download the .zip file. Extract it to a file path where the length of the name is fewer than 260 characters.

1. Open a console window then navigate to the ms-identity-docs-code-dotnet/console-daemon directory:

   cd ms-identity-docs-code-dotnet/console-daemon
   

2. Open Program.cs and replace the file contents with the following snippet;

    // Full directory URL, in the form of https://login.partner.microsoftonline.cn/<tenant_id>
    Authority = " https://login.partner.microsoftonline.cn/Enter_the_tenant_ID_obtained_from_the_Microsoft_Entra_admin_center",
    // 'Enter the client ID obtained from the Microsoft Entra admin center
    ClientId = "Enter the client ID obtained from the Microsoft Entra admin center",
    // Client secret 'Value' (not its ID) from 'Client secrets' in the Microsoft Entra admin center
    ClientSecret = "Enter the client secret value obtained from the Microsoft Entra admin center",
    // Client 'Object ID' of app registration in Microsoft Entra admin center - this value is a GUID
    ClientObjectId = "Enter the client Object ID obtained from the Microsoft Entra admin center"
   

   • Authority - The authority is a URL that indicates a directory that MSAL can request tokens from. Replace Enter_the_tenant_ID_obtained_from_the_Microsoft_Entra_admin_center with the Directory (tenant) ID value that was recorded earlier.
   • ClientId - The identifier of the application, also referred to as the client. Replace the text in quotes with the Application (client) ID value that was recorded earlier from the overview page of the registered application.
   • ClientSecret - The client secret created for the application in the Microsoft Entra admin center. Enter the value of the client secret.
   • ClientObjectId - The object ID of the client application. Replace the text in quotes with the Object ID value that you recorded earlier from the overview page of the registered application.

In your editor, open the .env file, then replace the placeholders:

• Enter_the_Application_Id_Here with the application (client) ID of the application you registered earlier.
• Enter_the_Tenant_Id_Here with the Tenant ID of your workforce tenant.
• Enter_the_Client_Secret_Here with the client secret you created earlier.
• Enter_the_Cloud_Instance_Id_Here with https://login.partner.microsoftonline.cn.
• Enter_the_Graph_Endpoint_Here with https://microsoftgraph.chinacloudapi.cn/.

1. Navigate to the 1-Call-MsGraph-WithSecret directory.

2. In your editor, open the parameters.json file and replace the placeholders:

   • Enter_the_Application_Id_Here with the application (client) ID of the application you registered earlier.
   • Enter_the_Tenant_Id_Here with the Tenant ID of your workforce tenant.
   • Enter_the_Client_Secret_Here with the client secret you created earlier.

1. Navigate to the msal-client-credential-secret directory.

2. In your editor, open the src\main\resources\application.properties file and replace the placeholders:

   • Enter_the_Application_Id_Here with the application (client) ID of the application you registered earlier.
   • Enter_the_Tenant_Id_Here with the Tenant ID of your workforce tenant.
   • Enter_the_Client_Secret_Here with the client secret you created earlier.

From your console window, run the following command to build and run the application:

dotnet run

Once the application runs successfully, it displays a response similar to the following snippet (shortened for brevity):

{
"@odata.context": "https://microsoftgraph.chinacloudapi.cn/v1.0/$metadata#applications/$entity",
"id": "00001111-aaaa-2222-bbbb-3333cccc4444",
"deletedDateTime": null,
"appId": "00001111-aaaa-2222-bbbb-3333cccc4444",
"applicationTemplateId": null,
"disabledByMicrosoftStatus": null,
"createdDateTime": "2021-01-17T15:30:55Z",
"displayName": "identity-dotnet-console-app",
"description": null,
"groupMembershipClaims": null,
...
}

A daemon application acquires a token on behalf of itself (not on behalf of a user). Users can't interact with a daemon application because it requires its own identity. This type of application requests an access token by using its application identity by presenting its application ID, credential (secret or certificate), and an application ID URI. The daemon application uses the standard OAuth 2.0 client credentials grant flow to acquire an access token.

The app acquires an access token from Microsoft identity platform. The access token is scoped for the Microsoft Graph API. The app then uses the access token to request its own application registration details from Microsoft Graph API. The app can request any resource from Microsoft Graph API as long as the access token has the right permissions.

The sample demonstrates how an unattended job or Windows service can run with an application identity, instead of a user's identity.

1. To install dependencies, run the following command:

   npm install
   

2. Use the following command to run the application:

   node . --op getUsers
   

If the app runs successfully, you should see a JSON formatted output representing a list of all users from your workforce tenant. It looks similar to the following snippet:

{
  '@odata.context': 'https://microsoftgraph.chinacloudapi.cn/v1.0/$metadata#users',
  value: [
    {
      businessPhones: [],
      displayName: 'Casey Jensen',
      givenName: 'Jense',
      jobTitle: null,
      mail: null,
      mobilePhone: null,
      officeLocation: null,
      preferredLanguage: null,
      surname: 'Casey',
      userPrincipalName: 'jensen@contoso.partner.onmschina.cn',
      id: 'aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb'
    },
    ...
  ]
}

A daemon application acquires a token on behalf of itself (not on behalf of a user). Users can't interact with a daemon application because it requires its own identity. This type of application requests an access token by using its application identity by presenting its application ID, credential (secret or certificate), and an application ID URI. The daemon application uses the standard OAuth 2.0 client credentials grant flow to acquire an access token.

The app acquires an access token from Microsoft identity platform. The access token is scoped for the Microsoft Graph API. The app then uses the access token to read all users in the tenant from Microsoft Graph API. The app can request any resource from Microsoft Graph API as long as the access token has the right permissions. In this case, we granted the app User.Read.All app permission so that it read all users' full profiles.

The sample demonstrates how an unattended job or Windows service can run with an application identity, instead of a user's identity.

1. To install dependencies, run the following command:

   pip install -r requirements.txt
   

2. To run the application, use the following command:

   python confidential_client_secret_sample.py parameters.json
   

If the app runs successfully, you should see a JSON formatted output representing a list of all users from your workforce tenant. It looks similar to the following snippet:

{
  '@odata.context': 'https://microsoftgraph.chinacloudapi.cn/v1.0/$metadata#users',
  value: [
    {
      businessPhones: [],
      displayName: 'Casey Jensen',
      givenName: 'Jense',
      jobTitle: null,
      mail: null,
      mobilePhone: null,
      officeLocation: null,
      preferredLanguage: null,
      surname: 'Casey',
      userPrincipalName: 'jensen@contoso.partner.onmschina.cn',
      id: 'aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb'
    },
    ...
  ]
}

A daemon application acquires a token on behalf of itself (not on behalf of a user). Users can't interact with a daemon application because it requires its own identity. This type of application requests an access token by using its application identity by presenting its application ID, credential (secret or certificate), and an application ID URI. The daemon application uses the standard OAuth 2.0 client credentials grant flow to acquire an access token.

The app acquires an access token from Microsoft identity platform. The access token is scoped for the Microsoft Graph API. The app then uses the access token to read all users in the tenant from Microsoft Graph API. The app can request any resource from Microsoft Graph API as long as the access token has the right permissions. In this case, we granted the app User.Read.All app permission so that it read all users' full profiles.

The sample demonstrates how an unattended job or Windows service can run with an application identity, instead of a user's identity.

You can test the sample app by running the main method of ClientCredentialGrant.java from your IDE or

1. From your console, run the following command:

   $ mvn clean compile assembly:single
   

   This command generates a msal-client-credential-secret-1.0.0.jar file in your /targets directory.

2. Navigate to the /targets directory, then run your Java executable file using the following command:

   $ java -jar msal-client-credential-secret-1.0.0.jar
   

If the app runs successfully, you should see a JSON formatted output representing a list of all users from your workforce tenant. It looks similar to the following snippet:

{
  '@odata.context': 'https://microsoftgraph.chinacloudapi.cn/v1.0/$metadata#users',
  value: [
    {
      businessPhones: [],
      displayName: 'Casey Jensen',
      givenName: 'Jense',
      jobTitle: null,
      mail: null,
      mobilePhone: null,
      officeLocation: null,
      preferredLanguage: null,
      surname: 'Casey',
      userPrincipalName: 'jensen@contoso.partner.onmschina.cn',
      id: 'aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb'
    },
    ...
  ]
}

A daemon application acquires a token on behalf of itself (not on behalf of a user). Users can't interact with a daemon application because it requires its own identity. This type of application requests an access token by using its application identity by presenting its application ID, credential (secret or certificate), and an application ID URI. The daemon application uses the standard OAuth 2.0 client credentials grant flow to acquire an access token.

The app acquires an access token from Microsoft identity platform. The access token is scoped for the Microsoft Graph API. The app then uses the access token to read all users in the tenant from Microsoft Graph API. The app can request any resource from Microsoft Graph API as long as the access token has the right permissions. In this case, we granted the app User.Read.All app permission so that it read all users' full profiles.

The sample demonstrates how an unattended job or Windows service can run with an application identity, instead of a user's identity.

• Learn by building this ASP.NET web app with the series Tutorial: Register an application with the Microsoft identity platform.

• Quickstart: Deploy an ASP.NET web app to Azure App Service

• Learn how build your Node.js daemon application that calls web API.

• Learn how to build a Python daemon application that calls web APIs

• Learn how to build a Java daemon application that calls web APIs