title: How to use ConfidentialClientApplication to perform AppOnly requests to Graph (Group.ReadWrite.All)
body: <p>I've been playing with MSAL <code>Microsoft.Identity.Client.ConfidentialClientApplication</code> to perform app-only Microsoft Graph - Groups operations.</p>
  
  <pre class="lang-cs prettyprint-override"><code>var RedirectUri = "urn:ietf:wg:oauth:2.0:oob";
  var clientApplication = new ConfidentialClientApplication(ClientId, RedirectUri, new ClientCredential(ClientSecret), null);
  </code></pre>
  
  <p>I'm stuck at the next step:</p>
  
  <pre class="lang-cs prettyprint-override"><code>authenticationResult = clientApplication.AcquireTokenSilentAsync(new string[]{"Group.ReadWrite.All"}).GetAwaiter().GetResult();
  </code></pre>
  
  <p>I get error <code>failed_to_acquire_token_silently</code>.</p>
  
  <pre class="lang-cs prettyprint-override"><code>authenticationResult = clientApplication.AcquireTokenForClient(new string[]{"Group.ReadWrite.All"}, string.Empty).GetAwaiter().GetResult();
  </code></pre>
  
  <p>I get error <code>invalid_scope</code>.</p>
  
  <p>Not sure which direction I should continue.</p>
  
  <p>Notes: </p>
  
  <ul>
  <li>With <code>PublicClientApplication</code> the same code works fine </li>
  <li>The app has both AppOnly <code>Group.ReadWrite.All</code> and Delegate <code>Group.ReadWrite.All</code> permissions </li>
  <li>With <code>PublicClienApplication</code> there's an unwanted UI dialog...</li>
  </ul>
  
  <pre class="lang-cs prettyprint-override"><code>var clientApplication = new PublicClientApplication(ClientId);
  authenticationResult = clientApplication.AcquireTokenAsync(Scopes).GetAwaiter().GetResult();
  </code></pre>