Fetching user information from Azure AD - azure

Question

I have created an application on Azure AD and I have assigned User.Read.All permission to my application.
That being said, I can generate an access token for the app from Postman. When generating access token I supply -
client_id: xxxx
client_secret: yyyy
grant_type: client_credentials
scope: https://graph.microsoft.com/.default
Using the generated access token (as header Authorization: Bearer zzzz) I send a GET request to https://graph.microsoft.com/v1.0/users/jhon.doe#domain.com. Which gives me error -
403 Forbidden
{
"error": {
"code": "Authorization_RequestDenied",
"message": "Insufficient privileges to complete the operation.",
"innerError": {
"request-id": "aaa-bbb-ccc-ddd",
"date": "2019-09-10T12:44:46"
}
}
}
Can anyone tell me what wrong I am doing?
Thanks in advance.

Answer 1

You need to add Application permissions.
Not delegated permissions.
In your screenshot we can see that they are delegated, which means they only apply in situations where there is a user involved in the authentication.
Since you use client credentials authentication, there is no user involved, only the app.
When you add required permissions, there should be an option to choose between Delegated and Application.
Choose Application, choose the necessary permissions, and grant them.