Microsft Graph API as WEB API application - azure

Question

I am banging my head for sometime now. I want to develop Web API which will be consume in my Angular APP. Purpose of API is to create/delete Microsoft Teams using Graph API.
I do have azure app with appropriate permission. and below is my code which keep giving me 403 error.
Can someone please help me ? also, do i have to apply permission to below option to access Grpah API without user interaction (as in Login Popup)
IConfidentialClientApplication confidentialClientApplication = ConfidentialClientApplicationBuilder
.Create("d78eaba6-12fe-8139")
.WithTenantId("fd49ee20-51a4-d930e2db05de")
.WithClientSecret("WTeN7A7-oeOfi~c9gF..")
.Build();
var scopes = new string[] { "https://graph.microsoft.com/.default" };
var authResult = await confidentialClientApplication.AcquireTokenForClient(scopes).ExecuteAsync();
string token = authResult.AccessToken;
await CallWebApiAndProcessResultASync("GET","https://graph.microsoft.com/v1.0/users", token, null, Display);
public static async Task CallWebApiAndProcessResultASync(string method,string webApiUrl, string accessToken, StringContent postValue, Action<JObject> processResult)
{
string request = string.Empty;
if (!string.IsNullOrEmpty(accessToken))
{
using (HttpClient HttpClient = new HttpClient())
{
var defaultRequestHeaders = HttpClient.DefaultRequestHeaders;
if (defaultRequestHeaders.Accept == null || !defaultRequestHeaders.Accept.Any(m => m.MediaType == "application/json"))
{
HttpClient.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
}
defaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
using (HttpRequestMessage httpRequestMessage = new HttpRequestMessage(new HttpMethod(method), webApiUrl) { Content = postValue })
{
var response = HttpClient.SendAsync(httpRequestMessage).Result;
if (response.IsSuccessStatusCode)
{
string json = await response.Content.ReadAsStringAsync();
JObject result = JsonConvert.DeserializeObject(json) as JObject;
Console.ForegroundColor = ConsoleColor.Gray;
processResult(result);
}
else
{
Console.ForegroundColor = ConsoleColor.Red;
Console.WriteLine($"Failed to call the Web Api: {response.StatusCode}");
string content = await response.Content.ReadAsStringAsync();
// Note that if you got reponse.Code == 403 and reponse.content.code == "Authorization_RequestDenied"
// this is because the tenant admin as not granted consent for the application to call the Web API
Console.WriteLine($"Content: {content}");
}
}
Console.ResetColor();
}
}
}

Answer 1

Yes, if you don’t need user interaction, you just need to grant application permissions for your application, and grant admin consent for the permissions you added. If you need to call MS Graph API to create/delete Microsoft Teams, please grant your application Directory.ReadWrite.All permission.