title: How to get access token to call MS Graph on behalf of a user in the console app using MSAL?
body: <p>I have a SPA application that communicates with my backend Web API using AAD v2 authentication. Now I'm developing a console app to call Microsoft Graph on behalf of the user signed into the SPA app.</p>
  
  <p>I have a valid access token of the user (used to call backend Web API). I want to use this access token to request a new token for accessing MS Graph.</p>
  
  <p>Here is the code of the console app for requesting a new access token with MS Graph scopes using MSAL.NET:</p>
  
  <pre><code>string clientId = "&lt;clientId&gt;";
  string clientSecret = "&lt;clientSecret&gt;";
  string accessToken = "&lt;validAccessTokenForWebApi&gt;";
  string assertionType = "urn:ietf:params:oauth:grant-type:jwt-bearer";
  string[] scopes = new string[] { "User.Read", "Mail.Send" };
  string graphAccessToken = null;
  
  try
  {
      var app = ConfidentialClientApplicationBuilder
                  .Create(clientId).WithClientSecret(clientSecret).Build();
  
      var userAssertion = new UserAssertion(accessToken, assertionType);
  
      var result = app.AcquireTokenOnBehalfOf(scopes, userAssertion)
                      .ExecuteAsync().GetAwaiter().GetResult();
  
      graphAccessToken = result.AccessToken;
  }
  catch (MsalServiceException ex)
  {
      throw;
  }
  </code></pre>
  
  <p>But when I call <code>app.AcquireTokenOnBehalfOf()</code> I get an exception:</p>
  
  <blockquote>
    <p>AADSTS50013: Assertion failed signature validation. [Reason - The provided signature value did not match the expected signature value., Thumbprint of key used by client: 'BB839F3453C7C04068B078EDADAB8E6D5F382E76', Found key 'Start=06/04/2019 00:00:00, End=06/04/2021 00:00:00']</p>
  </blockquote>
  
  <p>What is the reason? What is the right way of getting access token on behalf of a user?</p>
  
  <p><strong>UPDATE - why do I need console app?</strong></p>
  
  <p>I could call Graph API directly from my backend API, but some actions may be delayed by the user (e.g. send mail using Graph API after 30 minutes). That is why I need to do this using the console app that runs on schedule.</p>