Unlocking New Microsoft Graph Scopes: A Step-by-Step Guide to Adding Permissions to Existing Clients with Admin Consents

Microsoft Graph is a powerful tool that allows developers to access a vast range of Microsoft services, from Azure Active Directory to Office 365. However, as your application grows, so does its need for new permissions. In this article, we’ll explore how to add new Microsoft Graph scopes to an existing client with existing admin consents, ensuring a seamless and secure experience for your users.

Understanding Microsoft Graph Scopes and Admin Consents

Before we dive into the process, let’s quickly recap what Microsoft Graph scopes and admin consents are:

• Microsoft Graph Scopes: These are the specific permissions your application requires to interact with Microsoft services. Scopes define what actions your app can perform, such as reading user profiles or sending emails.
• Admin Consents: These are the permissions granted by an organization’s administrator, allowing your application to access specific resources on behalf of users within that organization.

Why Add New Scopes to an Existing Client?

There are several reasons why you might need to add new scopes to an existing client with existing admin consents:

• New Features: You’ve added new features to your application that require additional permissions.
• Expanded Functionality: You want to integrate your app with new Microsoft services or enhance existing integrations.
• Compliance and Security: You need to comply with new regulatory requirements or strengthen your application’s security posture.

Step 1: Prepare Your Azure AD Application

Before adding new scopes, make sure your Azure AD application is configured correctly:

1. Sign in to the Azure portal and navigate to the Azure Active Directory (Azure AD) section.
2. Select the application you want to modify and click on “App registrations” in the left-hand menu.
3. Click on the “API permissions” tab and review the existing permissions granted to your application.

Step 2: Identify the Required Scopes

Determine which new scopes your application requires:

• Consult the Microsoft Graph permissions reference to find the specific scopes needed for your new features or functionality.
• Use the Microsoft Graph permission helper tool to identify the required scopes based on your application’s functionality.

Step 3: Add New Scopes to Your Azure AD Application

Now it’s time to add the new scopes to your Azure AD application:

1. In the Azure portal, navigate to your application’s “App registrations” section.
2. Click on the “API permissions” tab and then click on “Add a permission”.
3. Select “Microsoft Graph” as the API and choose the new scopes you identified in Step 2.
4. Click “Add permission” to add the new scopes to your application.

Step 4: Request Admin Consent

Request admin consent for the new scopes:

1. Click on the “API permissions” tab and then click on “Grant admin consent”.
2. A popup will appear, requesting admin consent for the new scopes. Click “Yes” to grant consent.
3. If you’re not the administrator, you’ll need to provide the admin consent URL to the organization’s administrator for them to grant consent.

Step 5: Update Your Application Code

Update your application code to use the new scopes:

// Using the Microsoft Authentication Library (MSAL) for .NET
var scopes = new[] { "https://graph.microsoft.com/.default", "User.Read", "Mail.Read" };
var app = ConfidentialClientApplicationBuilder.Create(ClientId)
    .WithTenantId(TenantId)
    .WithClientSecret(ClientSecret)
    .Build();

var tokenAcquisitionResult = await app.AcquireTokenSilentAsync(scopes);

Step 6: Verify the New Scopes

Verify that the new scopes are working as expected:

• Use tools like Postman or cURL to test the new scopes and ensure your application can access the required resources.
• Review the Azure portal’s “API permissions” tab to confirm the new scopes are listed.

Troubleshooting Common Issues

If you encounter issues during the process, refer to the following troubleshooting tips:

Error	Solution
Error: “AADSTS65005: The application requires access to a resource that your organization has not subscribed to.”	Solution: Ensure the organization has subscribed to the required Microsoft service (e.g., Azure Active Directory or Microsoft 365).
Error: “AADSTS500011: The resource principal named [resource] was not found in the tenant.”	Solution: Verify the resource URL is correct and the application has the required permissions.

Conclusion

Adding new Microsoft Graph scopes to an existing client with existing admin consents is a straightforward process that requires careful planning and attention to detail. By following these steps, you’ll be able to expand your application’s capabilities while maintaining a secure and compliant environment for your users. Remember to stay up-to-date with the latest Microsoft Graph developments and best practices to ensure your application remains secure and scalable.

Happy coding!

Frequently Asked Question

Are you struggling to add new Microsoft Graph scopes to an existing client with existing admin consents? Don’t worry, we’ve got you covered! Here are some frequently asked questions and answers to help you navigate through this process.