title: How get user profile pic from AAD?
body: <p>I am successfully using AAD app services authentication with my app.  I can log in a user and retrieve their info.  However, I then try to use the access token I receive from AAD during the authentication to access the Microsoft Graph. (I want to retrieve the user's profile picture.) But I get an "Unauthorized" response.  Can I not use this token to access the Microsoft Graph?  Here's the code:</p>
  
  <p>I use this line to get a token from AAD:</p>
  
  <pre><code>result = await authContext.AcquireTokenAsync(ServiceResourceId, clientId, redirectUri, new PlatformParameters(PromptBehavior.Auto, false));
  </code></pre>
  
  <p>I then use the that token to ask for an access token from the Microsoft Graph:</p>
  
  <pre><code>var newresult = await authContext.AcquireTokenAsync("https://graph.microsoft.com", clientId, redirectUri, new PlatformParameters(PromptBehavior.Auto, false)); 
  </code></pre>
  
  <p>I then use this new token in the header of an HTTP request to the MS Graph:</p>
  
  <pre><code>var client = new HttpClient();
  string address = "https://graph.microsoft.com/v1.0/me/photo/$value";
  var request = new HttpRequestMessage(HttpMethod.Get, address);
  request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", newresult.AccessToken);
  var response = await client.SendAsync(request);
  </code></pre>
  
  <p>The response that is returned is always "Unauthorized." Can anyone help? When I registered this app with AAD, for Required Permissions, I checked all the boxes under MS Graph, just to be sure that wasn't the problem.</p>
  
  <p>Here is the jwt.io translation of the token I'm sending to the graph:</p>
  
  <p>Header:</p>
  
  <pre><code>{
        "typ": "JWT",
        "nonce": "AQABAAAAAABHh4kmS_aKT5XrjzxRAtHz1qgWQ-hlrP4_1OMfut-1OUpc-N2SpNqHzq0_d3W3onK3nxMYxfa_n0k1XDwY4goAv6zvokWoPOQ14gn-CiBj8yAA",
        "alg": "RS256",
        "x5t": "x478xyOplsM1H7NXk7Sx17x1upc",
        "kid": "x478xyOplsM1H7NXk7Sx17x1upc"
      }
  </code></pre>
  
  <p>Payload:</p>
  
  <pre><code>{
    "aud": "https://graph.microsoft.com",
    "iss": "https://sts.windows.net/8da014d8-253b-4fbc-92ad-8aff7ec75f3e/",
    "iat": 1513560920,
    "nbf": 1513560920,
    "exp": 1513564820,
    "acr": "1",
    "aio": "Y2NgYHhv82Ru/jov7wYf48xP1f+Y7Da5KRuVfFWb/XfGlv0c8ncB",
    "altsecid": "1:live.com:000161108451EADE",
    "amr": [
      "pwd"
    ],
    "app_displayname": "MyClientApp",
    "appid": "&lt;removed&gt;",
    "appidacr": "0",
    "e_exp": 262800,
    "email": "jdoe@hotmail.com",
    "family_name": "Doe",
    "given_name": "John",
    "idp": "live.com",
    "ipaddr": "&lt;removed&gt;",
    "name": "John Doe",
    "oid": "&lt;removed&gt;",
    "platf": "3",
    "puid": "&lt;removed&gt;",
    "scp": "Bookings.Manage.All Bookings.Read.All Bookings.ReadWrite.All BookingsAppointment.ReadWrite.All Calendars.Read Calendars.Read.Shared Calendars.ReadWrite Calendars.ReadWrite.Shared Contacts.Read Contacts.Read.Shared Contacts.ReadWrite Contacts.ReadWrite.Shared Device.Command Device.Read DeviceManagementApps.Read.All DeviceManagementApps.ReadWrite.All DeviceManagementConfiguration.Read.All DeviceManagementConfiguration.ReadWrite.All DeviceManagementManagedDevices.PrivilegedOperations.All DeviceManagementManagedDevices.Read.All DeviceManagementManagedDevices.ReadWrite.All DeviceManagementRBAC.Read.All DeviceManagementRBAC.ReadWrite.All DeviceManagementServiceConfig.Read.All DeviceManagementServiceConfig.ReadWrite.All Directory.AccessAsUser.All Directory.Read.All Directory.ReadWrite.All EAS.AccessAsUser.All EduAdministration.Read EduAdministration.ReadWrite EduAssignments.Read EduAssignments.ReadBasic EduAssignments.ReadWrite EduAssignments.ReadWriteBasic EduRoster.Read EduRoster.ReadBasic EduRoster.ReadWrite email Files.Read Files.Read.All Files.Read.Selected Files.ReadWrite Files.ReadWrite.All Files.ReadWrite.AppFolder Files.ReadWrite.Selected Financials.ReadWrite.All Group.Read.All Group.ReadWrite.All IdentityProvider.Read.All IdentityProvider.ReadWrite.All IdentityRiskEvent.Read.All Mail.Read Mail.Read.Shared Mail.ReadWrite Mail.ReadWrite.Shared Mail.Send Mail.Send.Shared MailboxSettings.Read MailboxSettings.ReadWrite Member.Read.Hidden Notes.Create Notes.Read Notes.Read.All Notes.ReadWrite Notes.ReadWrite.All Notes.ReadWrite.CreatedByApp offline_access openid People.Read People.Read.All profile Reports.Read.All Sites.FullControl.All Sites.Manage.All Sites.Read.All Sites.ReadWrite.All Tasks.Read Tasks.Read.Shared Tasks.ReadWrite Tasks.ReadWrite.Shared User.Invite.All User.Read User.Read.All User.ReadBasic.All User.ReadWrite User.ReadWrite.All UserTimelineActivity.Write.CreatedByApp",
    "sub": "9pWHLV_iWYAYPyU9jjECKINww-jeBz4dTxsYwCoHCfo",
    "tid": "&lt;removed&gt;",
    "unique_name": "live.com#jdoe@hotmail.com",
    "uti": "s-PBOt8MPE2gB0kwjIASAA",
    "ver": "1.0",
    "wids": [
      "62e90394-69f5-4237-9190-012177145e10"
    ]
  }
  </code></pre>