title: MS Graph API: invalid authentication token
body: <p>I'm trying to use the Microsoft Graph API to query an Outlook/O365 mailbox for messages. I <a href="https://graph.microsoft.io/en-us/docs/authorization/app_only" rel="noreferrer">registered my app</a> in the Azure portal and received the necessary information to query the API. The app has the <code>Mail.Read</code> permission. (I don't have access to the Azure portal, I was told it was set up this way.) When I get my token from the OAuth endpoint, however, it doesn't work in any subsequent calls. I'm using Python's requests module for testing right now.</p>
  
  <p>Why is this call failing? It seems like I'm passing all of the correct information but I'm clearly missing something.</p>
  
  <p>I'm getting the token by performing a <code>POST</code> on:</p>
  
  <pre><code>https://login.microsoftonline.com/my.domain/oauth2/token
  </code></pre>
  
  <p>I pass the necessary parameters:</p>
  
  <pre><code>data = {'grant_type': 'client_credentials', 'client_id': CLIENTID, 'client_secret': SECRET, 'resource': APPURI}
  </code></pre>
  
  <p>and I get a response like this:</p>
  
  <pre><code>{
      'resource': 'APPURI',
      'expires_in': '3599',
      'ext_expires_in': '3600',
      'access_token': 'TOKENHERE',
      'expires_on': '1466179206',
      'not_before': '1466175306',
      'token_type': 'Bearer'
  }
  </code></pre>
  
  <p>I try to use that token, however, and it doesn't work for anything I call. I'm passing it as a header:</p>
  
  <pre><code>h = {'Authorization': 'Bearer ' + TOKEN}
  </code></pre>
  
  <p>I'm calling this URL: </p>
  
  <pre><code>url = 'https://graph.microsoft.com/v1.0/users/my.email.address@example.com/messages'
  </code></pre>
  
  <p>Specifically, I use this:</p>
  
  <pre><code>r = requests.get(url, headers=h)
  </code></pre>
  
  <p>The response is a 401:</p>
  
  <pre><code>{
      'error': {
          'innerError': {
              'date': '2016-06-17T15:06:30',
              'request-id': '[I assume this should be removed for privacy]'
           },
           'code': 'InvalidAuthenticationToken',
           'message': 'Access token validation failure.'
       }
  }
  </code></pre>