title: Obtaining a valid access token for Microsoft Graph API
body: <p>I am working on an ASP.NET MVC5 Web App that uses Azure ADAL libraries to authenticate users, it works fine, however, when I manually send requests to graph, ex: GET <a href="https://graph.microsoft.com/v1.0/me" rel="nofollow noreferrer">https://graph.microsoft.com/v1.0/me</a> or GET <a href="https://graph.microsoft.com/v1.0/groups" rel="nofollow noreferrer">https://graph.microsoft.com/v1.0/groups</a>?$filter=from/displayName eq 'whatever'.</p>
  
  <p>I have tried updating the App Registration in Azure as to add the required Graph permissions, and I have also tried creating new app registrations, no matter what I do my requests will always respond 401 Unauthorized, is there anything I am missing?</p>
  
  <p>EDIT: Example response from Postman</p>
  
  <pre><code>{
    "error": {
      "code": "InvalidAuthenticationToken",
      "message": "Access token validation failure.",
      "innerError": {
        "request-id": "a142576b-acce-4e59-8a8d-adede61aaf59",
        "date": "2017-04-05T13:27:36"
      }
    }
  }
  </code></pre>
  
  <p>EDIT: C# Request Example</p>
  
  <pre><code>public async Task&lt;GroupGraph&gt; GetGroupIdByDisplayName(string displayName)
  {
      var accessToken = await authenticationService.GetTokenUserOnly();
      GroupGraph groupGraphResponse = null;
      using (var client = new HttpClient())
      {
          using (var request = new HttpRequestMessage(HttpMethod.Get, $"https://graph.microsoft.com/v1.0/groups?$filter=from/displayName eq '{displayName}'"))
              {
                  request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
                  using (var response = client.SendAsync(request).Result)
                  {
                      if (response.IsSuccessStatusCode)
                      {
                          using (var content = response.Content)
                          {
                              var result = await content.ReadAsStringAsync();
                              groupGraphResponse = JsonConvert.DeserializeObject&lt;GroupGraph&gt;(result);
                          }
                      }
                  }
              }
          }
          return groupGraphResponse;
      }
  </code></pre>
  
  <p>EDIT: The way I obtain the token</p>
  
  <pre><code>public async Task&lt;string&gt; GetTokenUserOnly()
      {
          string signedInUserID = ClaimsPrincipal.Current.FindFirst(ClaimTypes.NameIdentifier).Value;
          string tenantID = ClaimsPrincipal.Current.FindFirst("http://schemas.microsoft.com/identity/claims/tenantid").Value;
          string userObjectID = ClaimsPrincipal.Current.FindFirst("http://schemas.microsoft.com/identity/claims/objectidentifier").Value;
  
          // get a token for the Graph without triggering any user interaction (from the cache, via multi-resource refresh token, etc)
          ClientCredential clientcred = new ClientCredential(clientId, appKey);
          // initialize AuthenticationContext with the token cache of the currently signed in user, as kept in the app's database
          AuthenticationContext authenticationContext = new AuthenticationContext(aadInstance + tenantID, new TableTokenCache(signedInUserID));
          //AuthenticationResult authenticationResult = await authenticationContext.AcquireTokenSilentAsync(graphResourceID, clientcred, new UserIdentifier(userObjectID, UserIdentifierType.UniqueId));
          AuthenticationResult authenticationResult = authenticationContext.AcquireToken(graphResourceID, clientcred);
          return authenticationResult.AccessToken;
      }
  </code></pre>