In a multitenant application How can I check tenant data where the application is registered in the azure portal? - azure

Question

I have 2 SharePoint sites from different organizations (tenants):
Tenant 1: abc.sharepoint.com
Tenant 2: xyz.sharepoint.com
The necessary permissions for an application have been registered and given on the azure portal for Tenan 1 'abc.sharepoint.com' so that it can be accessed with Tenant 2 users: 'xyz.sharepoint.com'
Authentication works fine
The access to the data of the sharepoint lists work correctly when I am authenticated with the users of Tenant 1 'abc.sharepoint.com'
What I would like is that authenticated with a user of Tenant 2 'xyz.sharepoint.com' you can consult the data of sharepoint, Example:
When I make the request:
https://graph.microsoft.com/v1.0/sites/root or https://graph.microsoft.com/v1.0/sites/xyz.sharepoint.com
It returns the information satisfactorily, because it consults the site of 'xyz.sharepoint.com' since the users are from that tenant
... but when I consult specifying the tenant 'abc.sharepoint.com'
https://graph.microsoft.com/v1.0/sites/abc.sharepoint.com
Returns the following error:
{
"error": {
"code": "invalidRequest",
"message": "Invalid hostname for this tenancy",
"innerError": {
"request-id": "c0a8fa51-245b-4d1e-bf0b-5f32b6c0eb26",
"date": "2019-08-17T16:27:57"
}
}
}
One authenticated with the users of another tenant. How can I check the information that the application is registered?

Answer 1

We cannot use an access token got from one tenant to access another tenant.
If you want to do so, you need to:
Add the user of Tenant 2 'xyz.sharepoint.com' as a guest into Tenant
1 'abc.sharepoint.com'. See Quickstart: Add guest users to your directory in the Azure portal.
Use admin account from Tenant 1 to do admin-consent to the app registered in Azure AD of Tenant 2. Just need to open a browser and make a request to
https://login.microsoftonline.com/common/oauth2/authorize?client_id={client id of the app registered in Azure AD of Tenant 2}&response_type=code&redirect_uri={reply url of the app registered in Azure AD of Tenant 2}&nonce=1234&resource=https://graph.microsoft.com&prompt=admin_consent
Log in with the admin account of Tenant 1 and click "Accept".
Get the access token and use it to access Tenant 1 'abc.sharepoint.com'.