Microsoft Graph API Deep Dive

Transcription

1

2 Microsoft Graph API Deep Dive Donald Hessing Lead Architect, Capgemini, The Netherlands Microsoft Certified Master (MCM)

3 Agenda Introduction to Microsoft Graph API What is now and what is new in GA and Preview Authentication - Single Sign On and Caching DEMO s (SharePoint, Planner, Excel, Insights) SharePoint Add-ins versus Microsoft Graph

4 Introduction Microsoft Graph API

5

6 Office 365 by the numbers

7 Office platform What can I build?

8 Before Microsoft Graph Many different APIs to access data Seperate Auth stack for work and personal

9 Microsoft Graph API

10 Unified API Style & Single Endpoint Operation GET my profile GET my files GET my photo GET my mail GET my calendar GET my manager GET group conversations GET files trending around me Service Endpoint

11 What s been GA over the last year? Azure Active Directory Outlook mail, calendar and contacts Office 365 groups and conversations OneDrive drives and files WebHooks for Outlook data ShraePoint & LiveID profiles

12 What s new in GA? Excel API WebHooks for OneDrive Extend Graph with your own LOB info for Outlook FindMeetingTimes scheduling API

13 What s new in Preview? SharePoint Sites and Lists Hybrid On-premises support for social gestures Simpler query syntax without $ OneDrive large file upload Azure AD Administrative Units Invitation Manager Priviledge Identity Management Identity Protection Application Proxy Coming Soon Delta queries for Outlook and Azur Intune API Office 365 Reports

14 Graph, Graph, Graph Open Graph Microsoft Graph Azure AD Graph.

15 Microsoft Graph Authentication

16 Azure Active Directory and Office 365 Single auth flow for O365 Sign users in using OpenID Connect Azure AD, Exchange, SharePoint, Yammer, OneNote Device apps, web sites, SPAs, and service apps Admin and end-user consent Secure protocol OpenID Connect and OAuth 2.0 No capturing user credentials Fine-grained access scopes Supports MFA and federated user sign-in Long-term access through refresh tokens

17 Consent User Consent Consent provided by the user Any user in the organisation can install the application Implemented by default, but can be switched off by the Office 365 Admin Admin Consent Consent provided by an Office 365 Global Administrator Only Office 365 global administrators Consent is given to all users in the organisation

18 Register your Application Sign in to the Azure Management Portal Create a new application Select the Scope (Multi-Tenant) Generate Client Secret (Web apps only) Get Client ID Add Redirect URLs Select Permissions

19 DEMO APP Registration

20 Autentication to Office 365 Azure AD Authorization Azure AD Token Your Application Endpoint Endpoint Office 365 API Request authorization code Sign-in via browser pop-up Return authorization code Redeem authorization code and acquire access token for Office 365 resource Return id, access, and refresh tokens Call Office 365 API using the access token Return Http Response

21 Caching ADAL Tokens 1. ADAL needs to check the cache to see if there is already an access token for resource1 obtained by client1, or if there is a refresh token good for obtaining such an access token, and whatever other private heuristic you don t need to worry about. Right before it reads the cache, ADAL calls the BeforeAccess notification. Here, you have the opportunity of retrieving your persisted cache blob from wherever you chose to save it, and pump it in ADAL. 2. As we said, this is the first time that the application runs: hence the cache will (typically) be empty. Hence, ADAL pops out the authentication UX and guides the user through the authentication experience. Once it obtains a new token, it needs to save it in the cache: but right before that, it invokes the BeforeWrite notification. 3. After ADAL added the new token in its in-memory copy of the cache, it calls the AfterAccess notification. That notification is in fact called every time ADAL accessed the cache, not just when a write took place: however you can always tell if the current operation resulted in a cache change, as

22 Revoke User Consent Native Application Consent is part of the Refresh Token and typically stored on the device Revoke Consent typically means uninstall the application or clear TokenCache Web Server Applications Consent is stored in Azure Active Directory and not part of the Refresh Token User can Revoke Consent at

23 DEMO SharePoint Sites

24 DEMO Planner

25 DEMO Excel

26 DEMO Trending Around Me

27 App Only Operations

28 Azure AD App Only with Microsoft Graph Before background operations where done via an ACS ClientID / Client Secret Azure AD App Only provides: A more secure way of doing background operations by using a certificate trust relationship Consumption of other services than just Microsoft Graph Allows you to do multi tenant

29 App Only - Certificate Requires a certificate for authentication Azure AD will get the public key App will get the private key Use trusted certificates for production issued by a well Certificate Authority Can use self signed certificates for dev test (MakeCert.exe)

30 DEMO App Only calls with Microsoft Graph

31 Microsoft Graph versus SharePoint App Model

32 What makes SharePoint Add-in different?

33 SharePoint versus Graph

34 Calling from SharePoint App

35 DEMO Calling Microsoft Graph from SharePoint App

36 Key takeaways Microsoft Graph provides a single API end point including discoverability of Office 365 services Not a replacement of existing APIs like CSOM, and Exchange Web Services Great for composed device applications that spam a single end point For more advanced scenario s specific service API s like SharePoint CSOM is till required Microsoft Graph is protected by Azure AD compared to ACS for SharePoint CSOM