Read operation

Once users have successfully signed in to your app, they can edit their profiles. You enable the users to manage their profiles by using Microsoft Graph API's /me endpoint. Accessing the /me endpoint requires a signed-in user and therefore delegated permission. Delegated permissions in Microsoft Entra ID are used in scenarios where an application needs to access resources on behalf of a user, in this case Microsoft Graph API's /me endpoint.

By default, this operation returns only a subset of the user attributes. To retrieve attributes that are not returned by default, specify the additional properties using the $select option. Custom attributes can also be retrieved. To get the user's “identities” collection, use the $expand parameter.

User? profile = await _graphServiceClient.Me.GetAsync(requestConfiguration =>
    {
        requestConfiguration.QueryParameters.Select = new string[] { "Id", "identities", "displayName", "GivenName", 
                    "Surname", "Country", "City", "AccountEnabled", "CreatedDateTime", 
                    "lastPasswordChangeDateTime", $"extension_00000000000000000000000000000000_SpecialDiet" };
        
        requestConfiguration.QueryParameters.Expand = new string[] { "Extensions" };
    });

if (profile == null)
{
    att.ErrorMessage = "Profile data could not be retrieved.";
    return Ok(att);
}

ViewData["Greeting"] = $"Hello {profile.DisplayName}";

Write operation

To update the properties of a user using the POST method, it is advisable to require the user to complete a multi-factor authentication (MFA) challenge. This ensures that only the authorized user can make changes to their profile.

For example, your application acquires an access token to invoke a “middleware” web API you defined (source code) and registered in Microsoft Entra external ID. A Conditional Access policy enforces MFA for the “middleware” application registration. Then the middleware web API exchanges the access token on behalf of the user and calls the Microsoft Graph API /me endpoint.

In Microsoft Entra external ID, only specific built-in attributes can be modified. Read to the next section to learn how to update extension attributes. The following code snippet shows how to update the user profile using Microsoft Graph API.

public async Task OnPostAsync([FromForm] UserAttributes att)
{

    // Get the user unique identifier
    string? userObjectId = User.GetObjectId();

    if (userObjectId == null)
    {
        att.ErrorMessage = "The account update cannot be processed because the access token lacks the necessary 'objectidentifier' claim.";
    }

    var requestBody = new User
    {
        DisplayName = att.DisplayName,
        GivenName = att.GivenName,
        Surname = att.Surname,
        Country = att.Country,
        City = att.City
    };

    var result = await _graphServiceClient.Me.PatchAsync(requestBody);
}

Other operations

Other operations like security group association, application role assignment, enabling or disabling user accounts, and modifying extension attributes are done via OAuth 2.0 client credentials grant flow and the permissions are called application permissions. In this case the application acts on behalf of itself and not on behalf of the user. Therefore, it cannot call the /me endpoint; instead, it must call the users endpoint and provide the user's unique identifier.

var groups = await graphClient.Users[userObjectId].MemberOf.GetAsync();

Using client credentials grant flow

To call Microsoft Graph with application permissions, you need to follow these steps:

1. First, you need to register a Graph API application in Microsoft Entra external ID. Registering your application establishes a trust relationship between your app and the Microsoft identity platform. Once registered, you will receive a client ID and a tenant ID to configure in your application.
2. Next, add credentials to your application registration. Credentials allow your application to authenticate as itself, requiring no interaction from a user at runtime. You can choose one of the following options: certificates (recommended), client secrets (not recommended), and federated credentials.
3. Configure the necessary application permissions for Microsoft Graph. These permissions always require administrator consent.
4. Use the client credentials flow to obtain an access token. The client credential flow enables service applications to run without user interaction. When using the Microsoft Graph SDK, the Client credentials provider can be used.
5. Finally, to make requests to the Microsoft Graph API, use an access token. When using the Microsoft Graph SDK, provide the Client credentials provider to the GraphServiceClient object. The following code snippet shows how to create a GraphServiceClient object using the client credentials provider.

   // Get the certificate from the certificate store
   X509Certificate2 certificate = ReadCertificate(certificateThumbprint);
   
   // Created the client certificate credential object
   var clientCertificateCredential = new ClientCertificateCredential(tenantId, clientId, certificate);
   
   // Initiate the GraphServiceClient with the client certificate credential
   var graphClient = new GraphServiceClient(clientCertificateCredential, new string[] { "https://graph.microsoft.com/.default" });