How to Retrieve and Use Graph API Access Tokens for Sending Emails in C#

Streamlining Access Token Retrieval for Microsoft Graph API

Have you ever faced the inconvenience of manually retrieving an access token from Graph Explorer every day? It can be frustrating, especially when you're part of a busy team relying on automation to send emails via Microsoft Graph API. The manual process can quickly become a bottleneck in productivity. 🤔

In a bid to simplify this, I decided to build an Azure function that automatically retrieves the access token for my team. This solution eliminates the need for repetitive tasks and ensures everyone can focus on their core work instead of token management. It's like giving your workflow a much-needed caffeine boost! ☕

However, like most development journeys, this one wasn’t without its challenges. Despite successfully generating a token, I hit a roadblock: the token returned by my function didn’t match the one from Graph Explorer. This unexpected discrepancy raised several questions about its validity and functionality.

In this article, I'll share the code I used, the issues I encountered, and the steps I took to troubleshoot the problem. Whether you're building similar functionality or just curious about Azure and Graph API, this guide will walk you through the process with practical insights and relatable examples. Let’s dive in! 🚀

Command	Example of Use
FormUrlEncodedContent	This C# command is used to create a request body for POST requests with data encoded in application/x-www-form-urlencoded format. It simplifies passing key-value pairs to APIs that require this format.
HttpResponseMessage	Represents the response received from an HTTP request in C#. It allows you to check the status, headers, and content of the server's response.
EnsureSuccessStatusCode	A method that ensures the HTTP response status code is successful (2xx). If not, it throws an exception, making error handling straightforward.
JsonConvert.DeserializeObject<T>	This Newtonsoft.Json method is used to parse JSON strings into C# objects or dynamic types. It's critical for extracting the access token from API responses.
os.getenv	A Python method that retrieves environment variables. It's essential for securely accessing sensitive data like client IDs and secrets.
requests.post	A Python method to send HTTP POST requests. It's used here to call the Microsoft Graph API token endpoint with the necessary payload.
raise Exception	A Python command to explicitly raise exceptions when errors occur. This is used for error handling in case the API response is not successful.
Environment.GetEnvironmentVariable	This C# method fetches environment variables. It provides a secure way to access credentials without hardcoding them into the source code.
dynamic	A C# keyword that allows the creation of objects whose type is resolved at runtime. Useful for handling JSON responses with unpredictable structures.
httpClient.PostAsync	A C# method to send asynchronous HTTP POST requests. It is used here to call the token endpoint of Microsoft Identity.

Understanding and Optimizing Graph API Token Retrieval

To automate the process of sending emails using Microsoft Graph API, the first script demonstrates how to retrieve an access token using the Client Credentials flow in C#. This is especially useful when building server-side applications or services, such as an Azure Function, where no user interaction is required. The script securely fetches the token by using environment variables for storing sensitive data, like the `ClientId`, `ClientSecret`, and `TenantId`. This ensures security by avoiding hardcoded credentials in the source code.

The core of the solution revolves around the `FormUrlEncodedContent` class, which creates the request payload in the required format for authentication. Once the payload is ready, the `httpClient.PostAsync` method sends an HTTP POST request to the Microsoft Identity token endpoint. This call ensures that the app can programmatically retrieve a valid token, which can then be used to access resources such as Microsoft Graph API to send emails or manage data.

The Python example complements the C# script by providing a lightweight alternative for token retrieval. By leveraging the `os.getenv` method, it pulls sensitive credentials directly from the environment, much like the C# script. The `requests.post` function performs the token endpoint call, simplifying the process for developers more familiar with Python. Both scripts include robust error handling with `response.EnsureSuccessStatusCode` (C#) and explicit exception raising (`raise Exception`) in Python to manage issues like authentication failures or API errors.

One real-life example of applying these scripts would be a team notification system that sends emails to team members about critical events, such as upcoming deadlines or service outages. Instead of logging into Graph Explorer daily to retrieve tokens manually, these scripts automate the process, reducing human error and increasing efficiency. 🚀 This automation is not only time-saving but ensures that the system operates seamlessly, even during off-hours. Whether you choose C# for its integration with enterprise-level solutions or Python for its simplicity, both approaches address the core problem effectively. 😊

// Import necessary namespaces
using System;
using System.Net.Http;
using System.Threading.Tasks;
using System.Collections.Generic;
using Newtonsoft.Json;
using Microsoft.Extensions.Logging;
namespace GraphApiTokenFetcher
{
    public class TokenService
    {
        private static readonly HttpClient httpClient = new HttpClient();
        // Fetch access token using Client Credentials flow
        public static async Task<string> GetGraphAccessTokenAsync(ILogger log)
        {
            try
            {
                // Retrieve environment variables
                var clientId = Environment.GetEnvironmentVariable("ClientId");
                var clientSecret = Environment.GetEnvironmentVariable("ClientSecret");
                var tenantId = Environment.GetEnvironmentVariable("TenantId");
                var tokenEndpoint = $"https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token";
                // Prepare the request body
                var body = new FormUrlEncodedContent(new[]
                {
                    new KeyValuePair<string, string>("client_id", clientId),
                    new KeyValuePair<string, string>("scope", "https://graph.microsoft.com/.default"),
                    new KeyValuePair<string, string>("client_secret", clientSecret),
                    new KeyValuePair<string, string>("grant_type", "client_credentials")
                });
                // Make the HTTP POST request
                HttpResponseMessage response = await httpClient.PostAsync(tokenEndpoint, body);
                response.EnsureSuccessStatusCode();
                // Read and parse the response
                string responseContent = await response.Content.ReadAsStringAsync();
                var tokenResult = JsonConvert.DeserializeObject<dynamic>(responseContent);
                return tokenResult.access_token;
            }
            catch (Exception ex)
            {
                log.LogError($"Error fetching Graph API token: {ex.Message}");
                throw;
            }
        }
    }
}

# Import required libraries
import os
import requests
import json
# Function to fetch access token
def get_graph_access_token():
    client_id = os.getenv("ClientId")
    client_secret = os.getenv("ClientSecret")
    tenant_id = os.getenv("TenantId")
    token_endpoint = f"https://login.microsoftonline.com/{tenant_id}/oauth2/v2.0/token"
    # Prepare request payload
    payload = {
        "client_id": client_id,
        "client_secret": client_secret,
        "scope": "https://graph.microsoft.com/.default",
        "grant_type": "client_credentials"
    }
    # Send the POST request
    response = requests.post(token_endpoint, data=payload)
    if response.status_code == 200:
        return response.json().get("access_token")
    else:
        raise Exception(f"Failed to retrieve token: {response.text}")
# Retrieve and print token
if __name__ == "__main__":
    try:
        token = get_graph_access_token()
        print("Access Token:", token)
    except Exception as e:
        print("Error:", str(e))

Overcoming Challenges in Graph API Token Validation

When working with Microsoft Graph API, one critical challenge developers often face is ensuring the validity and scope of the access token. While retrieving a token using the Client Credentials flow is straightforward, its usability depends on the permissions granted to the application in Azure AD. A common oversight is failing to configure the API permissions correctly, leading to errors when using the token to send emails or perform other actions.

Another important consideration is understanding the difference between tokens retrieved through Graph Explorer versus programmatically generated tokens. Graph Explorer tokens are typically tied to a user’s context and their specific permissions, while programmatic tokens using the Client Credentials flow are application-scoped. This distinction explains why the returned tokens might not match, even if the underlying configurations seem similar.

To troubleshoot these discrepancies, you should verify that the application has the necessary Mail.Send or equivalent delegated permissions in the Azure portal. Additionally, inspecting the decoded token payload using a tool like [JWT.io](https://jwt.io) can help identify missing or incorrect claims, such as `scp` (scope) or `roles`. A real-world scenario where this would be critical is automating bulk email delivery for client notifications. Without proper configurations, the system might fail during production, affecting customer communication. Taking these steps ensures seamless integration and builds reliability into your solution. 😊

1. Why does my token not match the one from Graph Explorer?
2. Tokens retrieved programmatically use the , which scopes permissions to the application, unlike Graph Explorer's user-based tokens.
3. What is the role of the parameter in token requests?
4. The specifies the API access level, such as , ensuring proper access permissions.
5. How can I decode an access token?
6. Use tools like to inspect the payload of your token for claims, such as `scp` or `roles`, to validate permissions.
7. Why am I getting a "Bad Request" response when using my token?
8. Ensure your app has the required (e.g., ) configured in Azure AD and granted admin consent.
9. Can I refresh the token automatically?
10. Yes, you can programmatically retrieve a new token when it expires using the , bypassing the need for manual intervention.

By automating token retrieval for the , developers can save time and ensure secure, error-free processes. This method is particularly useful for server-side applications that need reliable access to resources without manual intervention. 😊

Understanding token scopes, permissions, and differences between user and app tokens is crucial to success. With these insights, you can confidently implement efficient workflows, minimizing disruptions and enhancing productivity for your team or organization.