Microsoft Graph API authorization and authentication for application development | BEENUM LEARNING | Skillshare

Playback Speed


1.0x


  • 0.5x
  • 0.75x
  • 1x (Normal)
  • 1.25x
  • 1.5x
  • 1.75x
  • 2x

Microsoft Graph API authorization and authentication for application development

teacher avatar BEENUM LEARNING, Simplifying Imaginations

Watch this class and thousands more

Get unlimited access to every class
Taught by industry leaders & working professionals
Topics include illustration, design, photography, and more

Watch this class and thousands more

Get unlimited access to every class
Taught by industry leaders & working professionals
Topics include illustration, design, photography, and more

Lessons in This Class

    • 1.

      CH_01_01: Introduction

      1:32

    • 2.

      CH_02_01: Overview and basics of Authorization and Authentication

      4:34

    • 3.

      CH_03_01: Register your app with Azure AD

      14:46

    • 4.

      CH_03_02: Get authorization code

      3:57

    • 5.

      CH_03_03: Get an access token and Call Microsoft Graph with the access token

      6:15

    • 6.

      CH_03_04: Use a refresh token to get a new access token

      4:07

    • 7.

      CH_04_01: Thank You and Congratulations!!!

      0:42

  • --
  • Beginner level
  • Intermediate level
  • Advanced level
  • All levels

Community Generated

The level is determined by a majority opinion of students who have reviewed this class. The teacher's recommendation is shown until at least 5 student responses are collected.

25

Students

--

Project

About This Class

Authentication and authorization basics:

To call Microsoft Graph, your app must acquire an access token from the Microsoft identity platform. The access token contains information about your app and the permissions it has to access the resources and APIs available through Microsoft Graph. To get an access token, your app must be registered with the Microsoft identity platform and be authorized by either a user or an administrator to access the Microsoft Graph resources it needs.

Register your app with the Microsoft identity platform

Before your app can get a token from the Microsoft identity platform, it must be registered in the Azure portal. Registration integrates your app with the Microsoft identity platform and establishes the information that it uses to get tokens, including:

  • Application ID: A unique identifier assigned by the Microsoft identity platform.

  • Redirect URI/URL: One or more endpoints at which your app will receive responses from the Microsoft identity platform. (For native and mobile apps, the URI is assigned by the Microsoft identity platform.)

  • Client secret: A password or a public/private key pair that your app uses to authenticate with the Microsoft identity platform. (Not needed for native or mobile apps.)

Microsoft Graph permissions

Microsoft Graph exposes granular permissions that control the access that apps have to resources, like users, groups, and mail. As a developer, you decide which Microsoft Graph permissions to request for your app. When a user signs in to your app they, or, in some cases, an administrator, are given a chance to consent to these permissions. If the user consents, your app is given access to the resources and APIs that it has requested. For apps that access resources and APIs without a signed-in user, permissions can be pre-consented to by an administrator when the app is installed.

Delegated and application permissions

Microsoft Graph has two types of permissions:

  • Delegated permissions are used by apps that have a signed-in user present. For these apps, either the user or an administrator consents to the permissions that the app requests and the app can act as the signed-in user when making calls to Microsoft Graph. Some delegated permissions can be consented by non-administrative users, but some higher-privileged permissions require administrator consent.

  • Application permissions are used by apps that run without a signed-in user present. For example, apps that run as background services or daemons. Application permissions can only be consented by an administrator.

Effective permissions

Effective permissions are the permissions that your app has when making requests to Microsoft Graph. The effective permissions are determined by a combination of the Microsoft Graph permissions that you granted to the app and the privileges of the signed-in user or the calling app. Within organizations, the policy or membership in one or more roles determine the privileges of the signed-in user or an app. It's important to understand the difference between the delegated and application permissions your app has and its effective permissions when making calls to Microsoft Graph.

Effective permissions in delegated versus application-only permission scenarios

  • For delegated permissions, the effective permissions of your app are the least-privileged intersection of the delegated permissions the app has been granted (by consent) and the privileges of the currently signed-in user. Your app can never have more privileges than the signed-in user.

    Suppose that your app has been granted the User.ReadWrite.All delegated permission and calls the Update user API. This permission nominally grants your app permission to read and update the profile of every user in an organization. However, because of effective permissions, the following restrictions apply to the privileges of the signed-in user:

    • If the signed-in user is a global administrator, your app can update the profile of every user in the organization.

    • If the signed-in user isn't in an administrator role, your app can update only the profile of the signed-in user. It won't update the profiles of other users in the organization because the signed-in user doesn't have those privileges.

  • For application permissions, the effective permissions of your app are the full level of privileges implied by the permission. For example, an app that has the User.ReadWrite.All application permission can update the profile of every user in the organization.

Meet Your Teacher

Teacher Profile Image

BEENUM LEARNING

Simplifying Imaginations

Teacher

Hello, 

We're BEENUM LEARNING, Oracle Cloud and Python content creator. We create content to help students and professionals to learn Oracle Cloud, Oracle Integration Cloud (Integration, Process, Visual Builder, B2B and Insight) and excel in their career. Please watch our courses to begin your career in Oracle with BEENUM LEARNING.

See full profile

Related Skills

Development Web Development
Level: Beginner

Class Ratings

Expectations Met?
    Exceeded!
  • 0%
  • Yes
  • 0%
  • Somewhat
  • 0%
  • Not really
  • 0%

Why Join Skillshare?

Take award-winning Skillshare Original Classes

Each class has short lessons, hands-on projects

Your membership supports Skillshare teachers

Learn From Anywhere

Take classes on the go with the Skillshare app. Stream or download to watch on the plane, the subway, or wherever you learn best.

Transcripts

1. CH_01_01: Introduction: Hello and welcome to this course. In this course, we are going to learn Microsoft Graph, API, authentication and authorization. We will learn the basics for developing any application which makes use of Microsoft Graph API. In order to make use of any of the resources on the Microsoft platform, we will learn how we can authenticate and authorize our application in order to interact with the APIs. The main focus here, with the help of which we are going to demonstrate this use case is we are considering that we are accessing male resource, that is e-mail client with the help of Microsoft Graph API. We are going to send the e-mail with the help of our application. And we are going to make use of extensively on cosmetic length is variable to make use of postmen plane, you can basically replicate that same in your application if you're developing in any language or any product. If you want to learn, you may need to practice along with us in order to gain the experience and showcase the skill. Also, please do share your feedback regularly with us so that we can improve the content for this course and bring the quality content to you. We would like to thank you for watching the introduction for this course. For any credit concern, please write to us binom dot abs at gmail.com or you can directly message us the Q&A available on this platform without wasting much time. Let's begin with the course. We hope that you are going to join along with us in this learning journey. 2. CH_02_01: Overview and basics of Authorization and Authentication: Before we start with our hands-on classes, here is the quick overview on Microsoft Graph. The basis of all the clusters in this course will be on this documentation on Microsoft Graph APIs. So I will share the link for this under resource section, please check out the link for more information. In the table of contents there is the OLAP authentication. And if you click on the overview, you will get a lot of resources from Microsoft, be developing with the help of SDKs available for Android, iOS, Python, Xamarin, or any other tools if you want to develop your own custom application and also Getting Started, checklist is also available and also the video. Coming to the basics, let's first learn what are the basics before going ahead with Microsoft Graph authentication authorization. Here it says in order to call Microsoft Graph, you must acquire an access tokens from Microsoft Identity platform. This token will contain the information about your app and the permission it has in order to access the resources and APIs available through Microsoft Graph. Basically this token will have the details of your app, which we need to register our app in Azure AD. And then we need to give some permissions to this app in order to access what resources, like the specific resources you can, as I am to that particular application, based on the roles you can restrict, based on the content, you can rest it. If it is an application on a daemon service, then you can stick. In other way. We learn all those things going ahead, like getting access on behalf of a user, get an access without the user and the permissions element. Basically, there are three things we need in order to register your app with the Microsoft Identity platform. You will get the application ID. As soon as you register an app in Azure AD will be getting this application ID of the client ID to give the URL redirect URI is like a callback URL. I suppose if you're calling from Postman, you should use the Postman is callback URI, where it has to receive the access token, refresh token. Also you have to register the same in the application in as well. And secret, this is nothing but the password kind of thing that your app users in order to authenticate before making use of any resources. So there are basically three permissions as I tour. That is for the exploding granular permissions which control access to your app. It can lead to the resource, user level group and the mean. So there are two types of permissions, delegated permission and the application permission relegated commissions are used by the application that has signed in user present. Light for these apps, either the user or the admin can promote the consent and the app will act as a signed in user in case of application permission. And this will run in the background without the sign-in user. For this, the administration can exclusively give their consent from the app level. Now a few things on the effective permissions, like ACTs or delegated permission, what and all the user or the application can perform. All those things are mentioned over here with the help of one of the permissions like user readwrite. All. They have explained. If the user is an admin user, then they will be able to modify the user details for all the users. If the user is not an administrator user, they can update only their own user details. They wouldn't be able to modify other user's details. The goal for the delegate, that is with the help of Graph API. But in the case of application permission, if they get the consent, then the application can update the profiles of every user in the organization. So we should be very careful when to apply this delegated permission and ventral, applying this application permission with the pictorial description Microsoft explained very nicely. You can have a look in detail what is access token and all is provided over here. Whatever steps I mentioned over here in the access on behalf of user, we are going to make use of this. And also a glimpse is provided on how to access without the user as well. In detail, if you want to know about permissions, you can click on this Permissions tab and have a look on each and every permissions available. We are not going to cover each and every permissions over here. As I told, we are going to demonstrate with the help of sending email. So we're going to add the permissions only for the meal and demonstrate the use case. That is, if you come to male permissions under permissions. So we will see in this tutorial about mail sent. So this is the permission which we are going to enter into this application for more details, you can check out these permissions page and use it accordingly and know the drawbacks and the usability without wasting much time. Let's begin with the hands-on classes. 3. CH_03_01: Register your app with Azure AD: Do you want to use Microsoft Graph rest APIs? That is to read and write resources on behalf of a user with the help of your application, then you are at the right place. In this video series, we are going to cover how to access any Microsoft Graph rest APIs. That is to read or write any resources on behalf of a user. I'm here in the official documentation page by Microsoft on authentication and authorization. I will provide the link for this in the description. Please check out the link for more details. Now, let's see what this means in brief. As it says, to use Microsoft Graph, that is to read and write resources on behalf of a user, your app must get an access token from the Microsoft Identity platform. And then it has this token to the request and send to the Microsoft Graph will learn in detail what this mean. Actually, this is nothing but it is making use of our 2 authorization code, grant flow. If you look at the steps in all in authentication and authorization in this odd 2 authorization code grant flow, it involves five steps. The first is we need to register our application with Azure AD, which we are going to do in this class itself. Then we will look at how to get authorized. We will generate a code. And with the help of that code, we are going to get the access token. And then we are going to make use of this access token. I'm going to make use of Microsoft Graphics PAs. For demonstration purpose, we will try to send an email with the help of graph APA mail service and send a mail from your Outlook account to Gmail account. Also there is a refresh token that unsweetened. See, this access tokens are short-lived, means they will be available to use only for predefined template that it will expire. Suppose if you want to use that service or the Graph API is still with the help of access token. With the help of refresh token, we can generate a new access token. The help of newly generated access token, we will be able to make a call to Microsoft Graph APIs in order to read or write any resources without wasting much time. Let's proceed without first step in authentication and authorization. The first step in watts, we have to register our app. In order to register our app, we need to click on this app registration portal. I'm clicking on this. So this will ask to login and belonging with me Outlook account. If you're using a corporate account that you can populate over here, click on Next. Next it will ask to enter the password. I will enter the password over here. I'm giving us. This is going to open up the portal.Azure.com. Once you are in the welcome screen, we need to follow a few steps in order to register our application. Let's go back to our documentation. This documentation says in order to configure an app that is to use our 2 authorization code grant flow. So the following values when registering an app, we look at how we can register an app. First thing is we need to get the application ID, which is assigned by the app registration portal. When we register an app will be available. Next is we need to generate a secret that we will see how we can do that. Redirect URI, we're going to test with the help of postmen so that TRA, populating the postman see directly like in your case, you can populate the redirect URI from where you're making the call, like no callback URL it is, suppose on generating the access token, right? It has to send back those tokens. It is basically that it says, let me go to portal.azure.com. First step is we need to click on this app registrations under as your services. Also, we can search our resources over here in the search bar. Let me click on this app registration. As I am going to demonstrate this use case with the help of Microsoft outflow, the same e-mail. We are having a blog on this by Microsoft, on Microsoft Docs.com. Now if you scroll down, there is a Postman collection and all if you want, you can just download. Now here it says how to create an Azure AD application. I'm going to follow those steps as we entered into this portal.azure.com. Next is we need to click on this app registrations. We have selected that and it has opened up bar application. I already have one application which I created previously, but for demonstration, I'm going to resist a running application. Nested says, we have to click on this New registration. Let me click on New registration. I will name this as Outlook APA. From here we need to select the accounts. The accounts in any organization directory, personal account or multi-tenant as well as personal Microsoft account. I'm making use of my personal Outlook account. So I'm selecting this one. If you are using your organization directly, then you can just select this using only personal Microsoft account that you can use. Let me click this so that I can demonstrate most of the use cases. What do you encounter with your personal or corporate records? Once then we need to click on Register. Now let's see the documentation. It says we need to set the redirect URI. This will do now. Now we need to save those details. When is the client ID? Let me copy this and save in Notepad. Let me save it over here. Nice dessert in and tidy this way if you want, we can just say, save it all here, then we need a client secret. So Client ID is nothing but this is the application ID client secret we are going to generate now. In order to generate the client secret, we need to follow those steps over here. Before that, let me populate the callback URL for the postman. That is this one. Let me copy this from here. What do I say? That is this option to add the redirect URI. Click on this pad a redirect URI. Here it'd be hard to click on this, Add a platform. From here we need to select this way. And here we need to populate the redirect URI. Once done, click on Configure. So our callback URL will be visible over here also at the time of registering the app. That also we can populate. If you want to know how we can do that, just go back to home. What applications, registrations we call new registration app. Here, if we scroll down, we can just select the web and populate a callback URL that also you can do. This is another method. Let me close this and go to our application that is Outlook API to now we have done this next step in all this, we have to add few permissions for the APA. Let me go to this beacon API. Permissions are here. Now we need to add few permissions. Click on Add permission. Now let's see what enol formation we need for sending an email. It says we need to search for this under delegated permissions. To request a permission, select this Microsoft Graph. Select this delegated permission. Delegated permission means your applications need to access the APA as the signed in user. So you can bypass this if you set as Application permissions so that your application runs as a background service that is without signing user will see how to do that. Click on Enter. Here. We need to select this Riedel. Let me verify it is correct. Click on Add permission. So this got added. Know we need to add few more permissions or yeah, let me check what it is under application permission that also you have to search for external item. Select this Microsoft Graph. Select application permission. Expand this and select this. After this, we need to add permissions for the meal. Let me search for male over here. It's over here. I want to send the mail, read the main, read, write this. I will select once the amplicon and permissions. So we are done with adding all the permissions. So the next step in all this, we need to get that line secret generated. In order to do that, click on these certificates and secrets. You can this new client secret. Here, we need to provide some name. I'm giving this post man secret formula. Then I'm setting experts in three months. You can do custom as well, go to customs and set your own start date and end date. Let me end this in three months we can add. So we need to make a note of this client secret. This is the value of client secret, which will be available only for short span once you switch over to another page from here, this will be masked. Let me copy this and save in the notepad. Secret ideals, I will say. Now we are done with generating our secret. We give the permissions. Now, let's go back to this place. Under registering your app. It says we need to have this application or the client ID that we have already. We have generated the secret and we have provided the redirect URI. Before moving ahead and testing our APA, let us know what through some basis. As we had seen under the permission, there are two permissions, delegated and application delegate permissions. These are used by the app. We tell sending user present, you should be present over there in order to access that application. For this app, either the user or an administration should explicitly provide the consent for the permission so that the API requests and the app can act as a sign-in user on your behalf and make use of Microsoft Graph APIs. Application permissions are used by the app, which can run without assigning user, like a demon or a background service. You can have a look at this. And also you can go for the permissions and see each and every permissions available under delegated as well as other applications. We had selected few, but there are many. Now we will make use of our generated client secret and send me an e-mail. I'm here in the documentation for this assignment. Here there is a sample provided. We can make use of this and send a mail with the help of postmen. Let me get you over to the Postman now. I'm hearing the postman client and now provided the APA over here in order to send them heal those details you can find in this APA documentation. That is this one I'm providing in the postmen Content-Type is Jason and HTTP method is post. I have copy pasted the exactly same JSON message over here in the body. Yeah, only I have modified the subject that is ought to Postman and the content I have replaced with Hello. This is the first male with Microsoft Graph API and e-mail address. I have updated accordingly. Now coming to authorization from the odd selected or 2. From here, we need to populate few things. One is the authentication URL, access token URL. Those details we can get from this side. We will learn in detail how we can generate authorization and tokens one-by-one. And instead of using this inbuilt or 2 featuring postmen, we will generate those tokens one-by-one, and we will make a call with a simple authentication or the basic authentication. So those URLs, you can find it over here. You can provide the tenant ID that is available under Overview more here. That is this one. Or you can use the comment I have made use of common as I'm using that personal account. So this, you can accordingly change the authorized URL. And for token, if you scroll down, there is the URL over here. That is this one. You need to provide again, the tenant. You can provide the foreman or you can provide that in NTID nausea Cloud account. Now once you populate all the details, you need to provide the scope as well. All of those are specific to the resources. Now here I'm making use of male same, adding this group. So again, the scope you can find under APA permissions, what we have added more to API permissions. This this one males and as I'm sending the message that is sent mail as any user that I'm providing the school board here. And that's it. Nothing else. And also you have to make sure the callback URL, redirect URI you have provided in the application while registering the app in Azure AD that you have to provide it over here. Once you provide all the details, just click on these cookies. As of now, there is no cookies available. I'm closing this. Just click on this good meal access token. Now if you see it, don't ask me to sign in because I have already provided application permission. So it will directly me over here where I just need to click on S. I don't have to sign it. That is because of application user type for meals and scope. So authentication has been completed. We can proceed and click on Use token. Now just click on this thing. So we will get a meal in our Gmail account. As you can see, its status is toward 0 to accepted. Now let's switch over to Gmail account and check whether we have got the e-mail or not. As you can see over here, I have this Yoda email with subject or 2 postmen, and here is the email body. This we have received from our Outlook account. That is this one. This is exactly similar to what details we had provided over here that is under subject and nobody content. So this was just a demonstration how we can register an app and how we can make use of the details, what we get in order to make use of the resources. But our main focus here is in this series to access on behalf of a user, wherein we will manually generate the authorization code. Then we will make a call to get the access token. Then we are going to make use of this graphic PAs and interact with the help of basic authentication, not with a2 0. So in step-by-step, we learn how we can do that. And in the end, in the last or final class, we will learn how to generate access token with the help of this, refresh tokens. 4. CH_03_02: Get authorization code: In our previous class, we had seen this step one, that is to register your app. That is to use the A2 0 authorization code grant flow. And that was first step. And the next step is to get the authorization. If you scroll down there is in detail provided over here what these authorization, the first step to getting an access token for many OpenID Connect and a2 0 flow is to redirect the user to identity platform with this. But here is the documentation, how we can do that. If you look at the code, we need to construct our URL, something like this. Here is something that we had seen in our previous class. If you are having the work called The School ID and can provide the tenant of your account. I'm using the common over here, the client ID and all we had seen how we can get that from the AMP. Response code is equal to redirect URI. It will be our postmen redirect URI, which we had provided while registering the app. Response code will be wary. Hold on. It could be a query or the form post we are selecting the query and scope offline access user lead Mildred. We will use offline access Mildred and mail sent. Offline access is used because we want to get the refresh token. In that case, we mentioned the scope as offline access here if you read which indicates that app needs a refresh token for long lived access to that resource. For that purpose, we are providing offline access as a scope and steer it is equal to 12345. That's what we provide. I have created the URL over here with the query parameter or the variables with the redirect URI. If you see over here, this is the post redirect URI followed by me, I'm pasting the client ID aria, response type is accord. We will get a code of authorization in the response. When we hit this in the browser, response mode is a query scope is offline axis mill rate and male-centered. Let me copy this and go to the browser. I'm providing this URL in the browser and taking on Enter. Now this will ask me to sign into my account. Let me sign in so that it will authorize. You can skip this step. If you get the admin to grant the consent to this IPA when we registering in the application. And giving S. Now, if you look at the URL over here, we are getting the response here in the code. This is what we had mentioned in the URL. That is, a response type is equal to code. Now, I will copy paste over here. So our code is this one with the help of this authorization code. In the next step, we will get the access token and also will face the refresh token because this code We are authorized to include cope offline access. Also, you can skip this step if you follow this documentation, that is to get the access without the user consent. Here the only difference is admin has to provide the content. Starting from November ninth, 2020. End-users will no longer be able to grant the consent to newly registered multi-tenant app, but admin consent can be provided. Here. There is a step how the admin consent to be taken. You create an app. You can just form this and get the consent of the admin. Once the content is provided, you can request for the access token. Non-adult authorization content will be sufficient in your case. For more details, you can have a look at this documentation. And also you should be having this application permission and cause. This will enable a demon or any application to interact with the Graph APIs without human intervention. So this is how we can do as we are making use of postmen. I'm following this method, the documentation link for both the radius I will provide in the description. Kindly check out the link. We have generated the code for authorization. In the next step, we will pass that good over here and get the token. And then we will send email as an example with the help of this access token. And also we'll look at how we can make use of request token and get fresh access token. 5. CH_03_03: Get an access token and Call Microsoft Graph with the access token: In order to use the OD 2 authorization code, grant flow, we had seen how we can register our app with Azure AD. Also, we had seen how to get the authorized code in our previous class. Have not watched our biggest clusters. Please check out those classes before proceeding ahead with this class. In this class, we are going to learn how to generate the access token. We will make use of the authorization code. Then we're going to gender the access token. Also, we are going to consume one of the graphic *****. The preferred one which we are considering for this demonstration purpose is the male send what we had seen in the plus one same Milton Graph API and we are willing to use, and we are going to send the email. Let's now go to the documentation for this, get an access code. I will scroll down. If you see over here, your app uses the authorization code. That is nothing but what we generated in our previous class. If you have forgotten, it is this one received in the previous step to request an access token by sending a post request that is due slash token endpoint. So here is the sample provided by Microsoft. We are ready, we can pass that in. And again, I'm passing the common. If you want, you can send that tenant ID over here that you will get from the overview step under directory or Latina and tidy. This is on the same plant also you can provide. And it is accepting few of the form parameters or the query parameters we can see one is the client ID, client ID we already have in this file we had copied from the overview of the application. I will attach this file in the resource section of this class. You may download that resource file and use as a reference. When is the client ID and if there is a scope, we are going to use offline axis. We have already seen this. We use the offline access. Then we are going to get the refresh token. If you don't pass offline access using only the user read or main grid, we will just get the access token. We need the offline access as well. Next is the code. This code is nothing but the authorization code. What we got in a previous step, redirect URL, it is our Postmates callback URL. It could be your application specific URL. Nettles, we can provide same we need to provide in the application registration also, when we register the app that is in the step one, let's do the grant type. We are passing here authorization code as we're passing the code. And the last one is the client secret. What we copied into our site by creating the app. That is this one client secret value. In detail documentation for each and every query parameter is provided in this table. You may have a look at this. Let us look at the response. Here we are getting the refresh token, access token expires in those things. This refresh token we can use and generate the new access token that also will look at how we can do that. Now let me switch over to the postman and execute. I already created the project for this. Here is the URL, so the common you can replace with your tenant ID as well. Now, as required, we created few parameters over here, which will be encoded here. Even you can go for the query parameter directly adding the question mark and each, and every key and value you can define over here, then type. As we had seen, I did the authorization code, client ID are provided from this fight with z hat squared at the beginning of this class. Next is the client secret Redirect URL should be matching with the redirect URI, what we had populated in the app. Next is the code. This code is the authorization code. This is very short-lived. So whatever we had copy pasted in our previous class, that will be expired if you don't consume it in the, in a short period of time. So let me regenerate it. So let me copy this from here and generate the coding in me go to browser, copy paste and enter lotteries. And at the URL level, it will send me the cold. Let me copy this from here. Go to Postman. I will populate the new code over here. Then let me concern. Now I'm getting the access token. Now let me copy this from here. It is. Here. Next is our refreshToken. Let me copy only the access token. But we get to our first project in our postmen, which we had tested in our registration app plus in their class, what we had done is we had populated all the details. We clicked on getting new access token. Then we had copy-pasted here the access token. Now we will skip that step and I will straightaway copy this access token here and t constant. Now, as you see, I'm getting to 0, do accept it. I should probably getting the e-mail also one more option. What we can do is we can go for this better token until we can go for basic authentication. Also, we can mention here better space and the token that also will work. Now I'm going for this bearer token and I will put the access token over here. What we generated in this token APA, I'm taking on Saturday, I'm getting to 0 do accepted status. Now, let me check whether I've got the e-mail or not. As you can see on the screen, I have received the email that is from the postmen that is with the help of this method. Access on behalf of a user, wherein we tried to register our app in Azure AD. We got the crime secret value. Then we want the authorization code. With the help of authorization code, we got the access token. And with the help of access token, we made a call to Graph API and face the access token. So like this, we have seen how we can access any Graph API, the help of access token and these steps you can use if you want to access on behalf of a user. Suppose you are building an application where you want to include those steps. Suppose if your application doesn't support the two legged authentication, that is, ought to 0 or three leg. Then you can go for this step-by-step approach as well. This is the approach how we can implement or 2 authorization code grant flow. In our next class, we will look at how we can make use of refresh token and generate the new access tokens so that we can access them Graph APIs. Please join us in that class. 6. CH_03_04: Use a refresh token to get a new access token: In our classes so far, to use the authorization code grant flow, we had seen how to register an app with Azure AD. We have seen how to get the authorization code. With the help of this code, we have seen how to generate the access token and then call Microsoft Graph email API and send the e-mail notification. So all four steps we had seen in our previous classes, if you haven't missed any of the class, are all the classes, please check out those classes before proceeding ahead with this class. In this class, we are going to learn how to use the refresh token. What we get from this access token API in order to get a new access token. So let me go to the documentation straightaway. If you go to the documentation, access tokens are short-lived and you must refreeze them after they expire in order to continue accessing those resources, you can do so by submitting another post request to slash token endpoint, this term providing the refresh token instead of core. So the only difference between those two calls to face the access token and to generate a new access token with the help of refresh, that is the code. Here, client ID. We'll send the scope and we're going to send refresh token, we're going to send drank trait will be refreshed underscore token. We are not willing to send authorization code this term and the client secret, that is only difference. And in response, we will be getting the refresh token, scope, access token, token type and expired. These are the response elements. What we'll get. Now, let me switch over to the postman and show you with the hands-on. I have created a new request over here under Microsoft collections, the refresh token. If you see the form parameters, what are created for URL encoding or the query parameters. Let me just drag it down here and I'm having a client ID scope, the refresh token drying type and the client secret. So this refresh token value we will get from the response of this token what we had seen in our previous class. So what we have done in our previous class is we had copied this access token and we had gone to this Send Email Project or the request here. We had put this under tokens. You don't send button so that it sent an e-mail for us. But this time we need to copy the refresh token value from here, copy, just right-click and copy. Go to refresh token. Here, under the refresh token, we have to remove earlier value and paste, in your case, you how to create the new project as I already created the project and already populated those form URL encoded values, I'm pasting it directly. The scope for which we had defined in the authorize, that is over here, offline access main read at males say like this we had done in the case of refresh token. And so we have to send a similar scopes, like me read mails, send an offline access. Once we populate all the details, click on this button. And in the response, you will see when this is going to expire. Then scope, token type and the access token, we're going to end the refresh token. So next time when you want to generate a new token, we have to make use of this request token populate over here, becomes then you will get a new access token. This you need to automate while building any application. Let me copy this access token. Go to our first project. Just remove and paste. Let me go to the body and modify like APA, I refresh token. And in subject also, I will add this refresh token phrase here. Then let me click on the Send button. I'm getting to 0 to accept it means we have successfully send the email. Let me switch over to Gmail account and show you the e-mail. As you can see on the screen, I have received the e-mail from my Outlook with the help of graphic BA with a subject that we had modified refresh token and in the body also I'm getting refresh token like this. We can enable this or 2 authorization code grant flow and generate our own solution and access Microsoft Graph APIs with the help of access token URL so we can create our applications in order to refresh these tokens and access Microsoft Graph APIs as and when required. 7. CH_04_01: Thank You and Congratulations!!!: You'd like to thank you, as well as congratulate you on successfully completing this course. We hope that you might have followed along with us and practice on the classes, whatever we have discussed in the course so far. Please do share your feedback over the Q&A or directly messages or read the email to us and let us know how we can improve the content. Please give us good ratings for this course, it takes lot of effort to bring the quality contents to you. We would like to thank you and wish you all the best in your learning journey for any query concern, please write to us at binom dot abs at gmail.com. Thank you once again and happy learning.