title: How can I access the Microsoft Graph API with the B2C currently logged in user's credentials
body: <p>I have an Azure Active Directory B2C with policies defined and an application registered in the B2C blade. I can use the OWIN pipeline within my .NET web application to sign a user into the application. But, that user doesn't seem to be able to access the Graph API with the JWT sent back from the AAD B2C. </p>
  
  <p>The first issue seems to be the scopes that are available. In my OWIN setup in the Startup.Auth.cs in my application, I have this code:</p>
  
  <pre><code>        private static string clientId = ConfigurationManager.AppSettings["ida:AppId"];
      private static string clientSecret = ConfigurationManager.AppSettings["ida:AppSecret"];
      private static string aadInstance = ConfigurationManager.AppSettings["ida:AadInstance"];
      private static string tenant = ConfigurationManager.AppSettings["ida:Tenant"];
      private static string redirectUri = ConfigurationManager.AppSettings["ida:RedirectUri"];
      private static string graphScopes = ConfigurationManager.AppSettings["ida:GraphScopes"];
  
      // B2C policy identifiers
      public static string SignUpPolicyId = ConfigurationManager.AppSettings["ida:SignUpPolicyId"];
      public static string SignInPolicyId = ConfigurationManager.AppSettings["ida:SignInPolicyId"];
  
      public void ConfigureAuth(IAppBuilder app)
      {
          app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
  
          app.UseCookieAuthentication(new CookieAuthenticationOptions());
  
          // Configure OpenID Connect middleware for each policy
          app.UseOpenIdConnectAuthentication(CreateOptionsFromPolicy(SignUpPolicyId));
          //app.UseOpenIdConnectAuthentication(CreateOptionsFromPolicy(ProfilePolicyId));
          app.UseOpenIdConnectAuthentication(CreateOptionsFromPolicy(SignInPolicyId));
      }
  </code></pre>
  
  <p>Later in this file, I have this:</p>
  
  <pre><code>        private OpenIdConnectAuthenticationOptions CreateOptionsFromPolicy(string policy)
      {
          return new OpenIdConnectAuthenticationOptions
          {
              // For each policy, give OWIN the policy-specific metadata address, and
              // set the authentication type to the id of the policy
              MetadataAddress = String.Format(aadInstance, tenant, policy),
              AuthenticationType = policy,
  
              // These are standard OpenID Connect parameters, with values pulled from web.config
              ClientId = clientId,
              RedirectUri = redirectUri,
              PostLogoutRedirectUri = redirectUri,
              Notifications = new OpenIdConnectAuthenticationNotifications
              {
                  AuthenticationFailed = AuthenticationFailed,
              },
              Scope = "openid profile offline_access",
              ResponseType = "id_token",
  
              // This piece is optional - it is used for displaying the user's name in the navigation bar.
              TokenValidationParameters = new TokenValidationParameters
              {
                  NameClaimType = "name",
                  SaveSigninToken = true,
              },
          };
      }
  </code></pre>
  
  <p>Where I set the scope, I tried using one of the scopes from <a href="https://msdn.microsoft.com/en-us/library/azure/ad/graph/howto/azure-ad-graph-api-permission-scopes" rel="nofollow noreferrer" title="here">here</a> in order to later access the graph. That gave me an invalid request error.</p>