Hi anonymous user · Thank you for reaching out.

To add required permissions in the token, you need to first copy the Client ID (aka App ID) that you are using in your request to get the Access Token and then navigate to:

Azure Portal > Azure Active Directory > App Registration > All Applications > Search with the ClientID/AppID copied earlier.

In that application Navigate to:

Api Permissions > Add a permission > Microsoft Graph > Delegated permissions > Expand User > Select required permissions as shown below. Once the permissions are added, click on Grant Admin Consent for your_tenant button.

Note : Delegated permissions are used when token is acquired under user context. If you are acquiring token under the context of Service Principal, you need to select Application permissions under Microsoft Graph while adding permissions.

After adding the permissions, you need to request for a new token and make sure the token includes the required permissions by decoding it at https://jwt.ms or https://jwt.io

-----------------------------------------------------------------------------------------------------------

Please " Accept the answer " if the information helped you. This will help us and others in the community as well.

Hi anonymous user · To find the clientID, you need to check the request being sent to https://login.microsoftonline.com for authentication. Client ID is sent as a parameter in the request url as highlighted in below sample request:

https://login.microsoftonline.com/xxxxxx.onmicrosoft.com/oauth2/v2.0/authorize?**client_id=d736a5a0-xxxx-xxxx-xxxx-d192b45e4aa7**&response_type=code&redirect_uri=https://jwt.ms&state=1234&response_mode=query&scope=openid

This was very helpful.

But, I don't like the security concerns regarding the very last step.

Posting your secret token to one of these URLs just seems like a bad idea. You are giving away your token to these sites. What assurance is there that these are associated with Microsoft? What assurance is there that these sites aren't used to collect app tokens for malicious reasons? I recommend avoiding the very last step above without further clarification and verification. Even with that, it's still a bad idea. Keep your secret token secret.