search

microsoft / Federal-Business-Applications

US Government Business Applications Demo Repository
MIT License
171 stars 59 forks source link

Feature Request: Recommend adding a section for making requests to Graph API #7

Closed lordneeko closed 3 years ago

lordneeko commented 3 years ago

There are several of us that have struggled to figure out Graph API within the DOD environment. The Explorer doesn't work, so we're shooting in the dark in many ways using PowerShell. If you'd add a section to this area showing how to connect to, authenticate, and make a simple Graph API call in the DOD environment that'd be great.

Also, as far as we have been able to tell, there is no documentation on what WORKS in Graph API for the DOD environment and what does not. We know there are some functions NOT available, but have no idea what those are. In something like Powerautomate, I have a site where I can go and see what connectors I have, but for Graph API (especially since we are only working in PowerShell), discovering what endpoints exist, what permission are set on our accounts, and how to authenticate to those endpoints has been very challenging.

SteveWinward commented 3 years ago

@lordneeko totally understood. I’ve asked the Graph API team to do a better job documenting our US Sovereign clouds including DoD. You can see the issue I posted to the team below,

https://github.com/microsoftgraph/microsoft-graph-docs-contrib/issues/3315

I will work to create a simple document that shows how you can use PowerShell to quickly test DoD graph api endpoints and see the scopes and permissions for the identity you are connecting with. Would that be helpful for you?

lordneeko commented 3 years ago

That'd be good, thanks

SteveWinward commented 3 years ago

@lordneeko I just added a new section to our US Gov PowerShell samples,

https://github.com/microsoft/Federal-Business-Applications/tree/main/demos/powershell-gov-samples#microsoft-graph-powershell

It shows how you can use the Microsoft Graph PowerShell SDK to connect to GCC, GCC High and DoD environments with both delegated and app only identities.

I also created a PowerShell script a long time ago that shows how to use raw PowerShell to do an app only test to Azure for Government graph api's. This uses an app secret vs a client cert like the PowerShell Graph SDK. I would recommend using the PowerShell Graph SDK in favor of doing something like this script below, but hopefully gives you another sample you can reference,

https://github.com/SteveWinward/Azure-Samples/blob/master/AAD/SampleAadToken_AzureForGovernment.ps1