获取O365用户的后台作业获得未经授权的异常

Question

我们正在尝试创建一个微服务模块，其工作是每天一次获取使用Microsoft Graph API（/users/）的所有用户，并对他们做一些事情。

然后我们得到了来自Azure Blade的管理同意。

var confidentialClientApplication = new ConfidentialClientApplication(
            this.applicationId,
            this.authority,
            this.redirectUri,
            this.credential,
            new TokenCache(),
            new TokenCache());

            var result = await confidentialClientApplication.AcquireTokenForClientAsync(new[] { "https://graph.microsoft.com/.default" });
            return result.AccessToken;

new GraphServiceClient(new DelegateAuthenticationProvider(
            async requestMessage =>
            {
                var graphToken = await this.graphAuthProvider.GetAccessTokenAsync();

                // Append the access token to the request
                requestMessage.Headers.Authorization = new AuthenticationHeaderValue("bearer", graphToken);
            }));

下面是我获得的令牌的有效负载（部分信息省略）

{
 "aud": "https://graph.microsoft.com",
 "iss": "https://sts.windows.net/<tenant_id>/",
 "iat": 1527833423,
 "nbf": 1527833423,
 "exp": 1527837323,
 "aio": "Y2dgYKgxbYzssLvLWfve6WbgtsdWAA==",
 "app_displayname": "<app_name>",
 "appid": "<app_id>",
 "appidacr": "1",
 "e_exp": 262800,
 "idp": "https://sts.windows.net/<tenant_id>/",
 "oid": "<subject_id>",
 "sub": "<subject_id>",
 "tid": "<tenant_id>",
 "uti": "-XvIySkmuUOuqmQI0l8CAA",
 "ver": "1.0"
}

然后尝试让用户访问，我收到一个错误，说应用程序没有访问该资源的权限。

Answer 1

发现了问题所在。结果我添加的是委托权限，而不是应用程序权限。