Get access token for Microsoft Graph

Question

I have a web application in C# through which I'm trying to get access token for Microsoft Graph API. I'm able to get tokens through using Client secret, but don’t want to get the token by using the client secret but get the token by other means, want to get tokens without client secrets. I'm successfully getting the tokens using secrets and have stored them in KeyVault but getting an alert for "Explicit Credentials are being used for your application/service principals", so require some alternative to get tokens. Is there any way to get tokens without secrets. Any help would be great.

Is the application an API or some kind of app which doesn't run in a browser? If so, then, no. — Ryan Wilson
– Ryan Wilson, Commented Sep 22, 2020 at 13:15
@RyanWilson It is a web application which run fine any browser. I'm asking other methods because it is giving me alerts for using Explicit Client Credentials. — Rupali
– Rupali, Commented Sep 23, 2020 at 5:56
You mean, you don’t want to get the token by using the client secret but get the token by other means? — Carl Zhao
– Carl Zhao, Commented Sep 23, 2020 at 6:10
You should explain your scenario , if that is web application you would acquire token in backend with secret , you can encrypt it or store in Azure Key Vault . If that is spa , using authorization code flow+pkce , if that is machine-to-machine (M2M) application , encrypt secret or store in Azure Key Vault. — Nan Yu
– Nan Yu, Commented Sep 23, 2020 at 7:58

Brijs · Accepted Answer · 2020-09-22 13:43:52Z

1

One can use ROPC oAuth grant based on username and password instead of using Client Secrets to get access tokens. Microsoft identity platform supports the OAuth 2.0 Resource Owner Password Credentials (ROPC) grant, which allows an application to sign in the user by directly handling their password. Refer, https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth-ropc Warning: Microsoft recommends you do not use the ROPC flow. In most scenarios, more secure alternatives are available and recommended. This flow requires a very high degree of trust in the application, and carries risks which are not present in other flows. You should only use this flow when other more secure flows can't be used.

answered Sep 22, 2020 at 13:43

Brijs

213 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Sruthi J · Accepted Answer · 2020-09-22 15:36:27Z

0

It is not a recommended way to use without client secret since due to security concerns.

If you still don't want to use client secret go with implicit grant flow which we can easily implement on the front end by maintaining SPA and passing token to the backend

edited Sep 22, 2020 at 15:36

answered Sep 22, 2020 at 15:16

Sruthi J

1,6221 gold badge7 silver badges8 bronze badges

Collectives™ on Stack Overflow

Get access token for Microsoft Graph

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related