How to Retrieve and Use Graph API Access Tokens for Sending Emails in C#

Streamlining Access Token Retrieval for Microsoft Graph API

Have you ever faced the inconvenience of manually retrieving an access token from Graph Explorer every day? It can be frustrating, especially when you're part of a busy team relying on automation to send emails via Microsoft Graph API. The manual process can quickly become a bottleneck in productivity. 🤔

In a bid to simplify this, I decided to build an Azure function that automatically retrieves the access token for my team. This solution eliminates the need for repetitive tasks and ensures everyone can focus on their core work instead of token management. It's like giving your workflow a much-needed caffeine boost! ☕

However, like most development journeys, this one wasn’t without its challenges. Despite successfully generating a token, I hit a roadblock: the token returned by my function didn’t match the one from Graph Explorer. This unexpected discrepancy raised several questions about its validity and functionality.

In this article, I'll share the code I used, the issues I encountered, and the steps I took to troubleshoot the problem. Whether you're building similar functionality or just curious about Azure and Graph API, this guide will walk you through the process with practical insights and relatable examples. Let’s dive in! 🚀

Understanding and Optimizing Graph API Token Retrieval

To automate the process of sending emails using Microsoft Graph API, the first script demonstrates how to retrieve an access token using the Client Credentials flow in C#. This is especially useful when building server-side applications or services, such as an Azure Function, where no user interaction is required. The script securely fetches the token by using environment variables for storing sensitive data, like the `ClientId`, `ClientSecret`, and `TenantId`. This ensures security by avoiding hardcoded credentials in the source code.

The core of the solution revolves around the `FormUrlEncodedContent` class, which creates the request payload in the required format for authentication. Once the payload is ready, the `httpClient.PostAsync` method sends an HTTP POST request to the Microsoft Identity token endpoint. This call ensures that the app can programmatically retrieve a valid token, which can then be used to access resources such as Microsoft Graph API to send emails or manage data.

The Python example complements the C# script by providing a lightweight alternative for token retrieval. By leveraging the `os.getenv` method, it pulls sensitive credentials directly from the environment, much like the C# script. The `requests.post` function performs the token endpoint call, simplifying the process for developers more familiar with Python. Both scripts include robust error handling with `response.EnsureSuccessStatusCode` (C#) and explicit exception raising (`raise Exception`) in Python to manage issues like authentication failures or API errors.

One real-life example of applying these scripts would be a team notification system that sends emails to team members about critical events, such as upcoming deadlines or service outages. Instead of logging into Graph Explorer daily to retrieve tokens manually, these scripts automate the process, reducing human error and increasing efficiency. 🚀 This automation is not only time-saving but ensures that the system operates seamlessly, even during off-hours. Whether you choose C# for its integration with enterprise-level solutions or Python for its simplicity, both approaches address the core problem effectively. 😊

// Import necessary namespaces
using System;
using System.Net.Http;
using System.Threading.Tasks;
using System.Collections.Generic;
using Newtonsoft.Json;
using Microsoft.Extensions.Logging;
namespace GraphApiTokenFetcher
{
    public class TokenService
    {
        private static readonly HttpClient httpClient = new HttpClient();
        // Fetch access token using Client Credentials flow
        public static async Task<string> GetGraphAccessTokenAsync(ILogger log)
        {
            try
            {
                // Retrieve environment variables
                var clientId = Environment.GetEnvironmentVariable("ClientId");
                var clientSecret = Environment.GetEnvironmentVariable("ClientSecret");
                var tenantId = Environment.GetEnvironmentVariable("TenantId");
                var tokenEndpoint = $"https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token";
                // Prepare the request body
                var body = new FormUrlEncodedContent(new[]
                {
                    new KeyValuePair<string, string>("client_id", clientId),
                    new KeyValuePair<string, string>("scope", "https://graph.microsoft.com/.default"),
                    new KeyValuePair<string, string>("client_secret", clientSecret),
                    new KeyValuePair<string, string>("grant_type", "client_credentials")
                });
                // Make the HTTP POST request
                HttpResponseMessage response = await httpClient.PostAsync(tokenEndpoint, body);
                response.EnsureSuccessStatusCode();
                // Read and parse the response
                string responseContent = await response.Content.ReadAsStringAsync();
                var tokenResult = JsonConvert.DeserializeObject<dynamic>(responseContent);
                return tokenResult.access_token;
            }
            catch (Exception ex)
            {
                log.LogError($"Error fetching Graph API token: {ex.Message}");
                throw;
            }
        }
    }
}

# Import required libraries
import os
import requests
import json
# Function to fetch access token
def get_graph_access_token():
    client_id = os.getenv("ClientId")
    client_secret = os.getenv("ClientSecret")
    tenant_id = os.getenv("TenantId")
    token_endpoint = f"https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/token"
    # Prepare request payload
    payload = {
        "client_id": client_id,
        "client_secret": client_secret,
        "scope": "https://graph.microsoft.com/.default",
        "grant_type": "client_credentials"
    }
    # Send the POST request
    response = requests.post(token_endpoint, data=payload)
    if response.status_code == 200:
        return response.json().get("access_token")
    else:
        raise Exception(f"Failed to retrieve token: {response.text}")
# Retrieve and print token
if __name__ == "__main__":
    try:
        token = get_graph_access_token()
        print("Access Token:", token)
    except Exception as e:
        print("Error:", str(e))

Overcoming Challenges in Graph API Token Validation

When working with Microsoft Graph API, one critical challenge developers often face is ensuring the validity and scope of the access token. While retrieving a token using the Client Credentials flow is straightforward, its usability depends on the permissions granted to the application in Azure AD. A common oversight is failing to configure the API permissions correctly, leading to errors when using the token to send emails or perform other actions.

Another important consideration is understanding the difference between tokens retrieved through Graph Explorer versus programmatically generated tokens. Graph Explorer tokens are typically tied to a user’s context and their specific permissions, while programmatic tokens using the Client Credentials flow are application-scoped. This distinction explains why the returned tokens might not match, even if the underlying configurations seem similar.

To troubleshoot these discrepancies, you should verify that the application has the necessary Mail.Send or equivalent delegated permissions in the Azure portal. Additionally, inspecting the decoded token payload using a tool like [JWT.io](https://jwt.io) can help identify missing or incorrect claims, such as `scp` (scope) or `roles`. A real-world scenario where this would be critical is automating bulk email delivery for client notifications. Without proper configurations, the system might fail during production, affecting customer communication. Taking these steps ensures seamless integration and builds reliability into your solution. 😊