title: 403 error when trying to GET https://graph.microsoft.com/v1.0/me in Power Automate Flow
body: <p>I am trying to access Microsoft Graph API via a Power Automate Flow.</p>
  <p>I've created an 'App Registration' in Azure AD and setup what I think should be the required API permissions for the GET request I am attempting.</p>
  <p>In Power Automate, I am using the approach where you generate an access token and then pass that in the header of subsequent requests.</p>
  <p>It generates the access token fine, but produces a 403 error when trying to GET:</p>
  <pre><code> https://graph.microsoft.com/v1.0/me
  </code></pre>
  <p>I've been looking into this for several hours and come across suggestions to go to <a href="https://jwt.ms" rel="nofollow noreferrer">https://jwt.ms</a> and paste in the access token, but when I do that, I don't know what I should be looking for.</p>
  <p><strong>Error when running manually triggered flow:</strong></p>
  <p>Action 'HTTP' failed</p>
  <p>Insufficient privileges to complete the operation.</p>
  <p>Status Code:  403</p>
  <p><strong>API Permissions in Azure AD</strong></p>
  <p><a href="https://i.stack.imgur.com/bSTRZ.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/bSTRZ.png" alt="enter image description here" /></a></p>
  <p><a href="https://docs.microsoft.com/en-us/graph/api/user-get?view=graph-rest-1.0&amp;tabs=http" rel="nofollow noreferrer">Here are the docs</a> which specify which permissions are required for the relevant GET request, ie:</p>
  <pre><code>Delegated (work or school account)  User.Read, User.ReadWrite, User.ReadBasic.All, User.Read.All, User.ReadWrite.All, Directory.Read.All, Directory.ReadWrite.All, Directory.AccessAsUser.All
  </code></pre>
  <p><strong>Authentication in Power Automate Flow</strong></p>
  <p><a href="https://i.stack.imgur.com/b7HrS.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/b7HrS.png" alt="enter image description here" /></a></p>
  <p><strong>Request in Power Automate Flow</strong></p>
  <p><a href="https://i.stack.imgur.com/OM8sG.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/OM8sG.png" alt="enter image description here" /></a></p>
  <p>Text values from the above screenshots are below in case anyone wants to try and replicate:</p>
  <p><strong>HTTP Authenticate Request:</strong></p>
  <pre><code>https://login.microsoftonline.com/@{variables('tenant_id')}/oauth2/token
  
  Content-Type   application/x-www-form-urlencoded
  
  client_id=@{variables('application_id')}&amp;client_secret=@{variables('secret_value')}&amp;resource=https://graph.microsoft.com&amp;grant_type=client_credentials
  </code></pre>
  <p><strong>HTTP GET Request:</strong></p>
  <pre><code>URI:  https://graph.microsoft.com/v1.0/me
  
  Authorization     Bearer @{body('Parse_JSON')?['access_token']} 
  </code></pre>
  <p><strong>Update:</strong></p>
  <p>I don't know if this is the correct answer or not, but I <em>think</em> Power Automate might require <code>Application</code> permissions as opposed to <code>Delegate</code> permissions in the Azure App Registration area.</p>
  <p>The following research lead me to this conclusion:</p>
  <p><strong>01)</strong>  <a href="https://www.youtube.com/watch?v=VJWFzdy2c4E&amp;t=242s" rel="nofollow noreferrer">https://www.youtube.com/watch?v=VJWFzdy2c4E&amp;t=242s</a><br />
  he adds <code>Application</code> permissions and not <code>Delegate</code> permissions</p>
  <p><strong>02)</strong></p>
  <blockquote>
  <p>You are obtaining a token via the confidential client flow, meaning you not running in the context of a user. Thus you should not be using the /me endpoint, but /users/objectID one...Or obtain a token via some of the delegate permissions flows.  <a href="https://docs.microsoft.com/en-us/answers/questions/3432/microsoft-graph-api-unable-to-get-logged-in-user-d.html" rel="nofollow noreferrer">Source</a></p>
  </blockquote>
  <p>I therefore changed to <code>Application</code> permissions, called this endpoint, and it worked fine:</p>
  <pre><code>https://graph.microsoft.com/v1.0/users   
  </code></pre>
  <p>Whether <code>Application</code> permissions are the best (or only?) approach when accessing Microsoft Graph from Power Automate, I don't know (maybe the method I used to authenticate <em>enforced</em> the use of <code>Application</code> permissions?).  I kind of like the idea of ensuring the Flow only performs actions that the user triggering the Flow is allowed to perform., but meh, atleast something is working at the end of the day.</p>