In a SharePoint Online (SPO) environment, I am trying to let any (non-admin) user query Microsoft Graph API information that requires the User.Read.All permission.

=> The aim is to make my own directory (any user would be able to search for anybody in the organization's Azure Active Directory (AAD)) because Office 365's Delve and Contacts do not show all the fields from the AAD (especially extensionAttributes). Also my site uses a custom masterpage.

Note: AAD users are not all in the SPO website so I can't use SP's API such as query, SP.user, siteusers.

It works well when I authenticate through the App using its client_secret, but when I authenticate through SharePoint via ADAL JS or MSAL JS (silent or popUp auth) I am granted only the User.Read (not .All) privilege.

I have updated the Azure App manifest to specify that the privilege should be granted for users coming from the App:

"appRoles": [
            "allowedMemberTypes": [
            "description": "Annuaire",
            "displayName": "Annuaire",
            "id": "d1613ef0-097a-44a0-b1d2-c13c02231a97",
            "isEnabled": false,
            "lang": null,
            "origin": "Application",
            "value": "User.Read.All"

Using JWT.io to analyze the tokens, I can see that when I request it from the connection made using the app_secret I have the following role:

  "aud": "https://graph.microsoft.com",
  "iss": "https://sts.windows.net/e6f27e96-***/",
  "roles": [

But when I request it from the SharePoint page using ADAL or MSAL I have only the following scope:

  "aud": "https://graph.microsoft.com",
  "iss": "https://sts.windows.net/e6f27e96-*****/",
  "scp": "User.Read",

I have also tried to use AAD Graph API with Directory.Read.All permission but the result is the same.

What shall I do to build my custom directory?

  • What permissions have you granted in azure if you look at the graphical interface – Johan Brännmar Nov 6 '19 at 18:23
  • Here are the permissions: imgur.com/5eVgzj0 – Ashor Livs Nov 6 '19 at 18:40
  • Have you granted the permissions in the azure portal? Actually pressed the button for granting permissions after you checked the checkbox? – Johan Brännmar Nov 6 '19 at 18:46
  • Yes, on the screenshot the 4th column indicated which permissions require admin consent and the last column indicates that these permissions have been granted by the tenant administrator. – Ashor Livs Nov 6 '19 at 18:47
  • Additional settings from the App properties: imgur.com/a/55g63Pz – Ashor Livs Nov 6 '19 at 18:53

In your provided screenshot i can see that the permission for User.Read.All is an application permission and not a Delegated permission that the MSAL and ADAL library uses together with the users credentials.

So set the correct permission User.Read.All as a Delegated permission and i think it will work.

enter image description here

  • Thanks, I've made a second app with Delegated permissions instead of Application permissions. Now I'm rewriting part of MSAL code because I'm getting this message ClientAuthError: User login is required. => Working on it, will keep you posted. – Ashor Livs Nov 6 '19 at 19:24
  • Great! I can only point you to the following github issue: github.com/AzureAD/microsoft-authentication-library-for-js/… Where the latest comment where added a week ago. So there seems to be a bug atm. – Johan Brännmar Nov 6 '19 at 19:43
  • @AshorLivs If i look into the documentation of msal they also user the scope User.ReadWrite when logging in. docs.microsoft.com/en-us/azure/active-directory/develop/… – Johan Brännmar Nov 6 '19 at 19:51
  • Johan, did you know that I've struggled for like 30 hours before posting? Now it looks like you found the culprit! Here's a login + token request + MSG query response: imgur.com/a/4FwkdtV Despite the acquireTokenSilent (which is out of this topic scope) I've finally achieved to use my Azure App as intended thanks to your answer! – Ashor Livs Nov 6 '19 at 19:58
  • Glad i could help :) – Johan Brännmar Nov 6 '19 at 20:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.