如何借助OpenID与Microsoft Graph枚举AAD组并创建服务客户端？

云上老周

2026-5-20

Got it, let's walk through this step by step to help you enumerate Azure AD (AAD) groups using OpenID and Microsoft Graph, including how to set up the service client with your provided parameters.

Core Flow Overview

First, the big picture: You'll use your OpenID credentials to request an access token for Microsoft Graph, then use that token to authenticate calls to Graph's group endpoints to list out AAD groups. Your provided parameters are exactly what we need to make this happen.

Step 1: Get an Access Token via OpenID

To interact with Microsoft Graph, you first need a valid access token. Using your parameters, you can request one via the client credentials flow (since you have an app key/secret, this is the right fit for service-to-service calls).

Here's how to make the token request manually (you can also use SDKs like MSAL for this):

POST https://login.windows.net/<tenant-id>/oauth2/token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials
&client_id=<your-openid-client-id>
&client_secret=<your-openid-app-key>
&resource=https://graph.windows.net

Replace <tenant-id> with the actual tenant ID from your token endpoint URL
Replace <your-openid-client-id> and <your-openid-app-key> with your provided values

If successful, you'll get a response containing an access_token — this is what you'll use to authenticate Graph requests.

Step 2: Create the Microsoft Graph Service Client

Once you have the access token, you can initialize the Graph service client. Below is an example using the official Microsoft Graph SDK for .NET (this is the most common approach, but similar patterns exist for other languages):

using Microsoft.Graph;
using Microsoft.Identity.Client;
using System.Net.Http.Headers;

// Your provided parameters
var clientId = "YOUR_OPENID_CLIENT_ID";
var clientSecret = "YOUR_OPENID_APP_KEY";
var tenantId = "YOUR_TENANT_ID"; // Extracted from your token endpoint URL
var graphResource = "https://graph.microsoft.com";

// Initialize the confidential client for token acquisition
var confidentialClient = ConfidentialClientApplicationBuilder
    .Create(clientId)
    .WithClientSecret(clientSecret)
    .WithAuthority($"https://login.windows.net/{tenantId}")
    .Build();

// Request token for Graph (using the .default scope for app permissions)
var scopes = new[] { $"{graphResource}/.default" };
var authResult = await confidentialClient.AcquireTokenForClient(scopes).ExecuteAsync();

// Build the Graph service client with authentication
var graphClient = new GraphServiceClient(new DelegateAuthenticationProvider((requestMessage) =>
{
    requestMessage.Headers.Authorization = new AuthenticationHeaderValue("Bearer", authResult.AccessToken);
    return Task.CompletedTask;
}));

Step 3: Enumerate AAD Groups

With the client set up, you can now call Graph's groups endpoint to list all AAD groups. Here's how to do it:

// Fetch all groups (you can add filters/selects to narrow results)
var groups = await graphClient.Groups.Request().GetAsync();

// Iterate through the results
foreach (var group in groups)
{
    Console.WriteLine($"Group ID: {group.Id}, Name: {group.DisplayName}, Description: {group.Description}");
}

If you want to refine the results (e.g., only get groups with a specific name, or select specific fields), you can use OData query parameters:

// Example: Get groups with "Team" in the name, and only return ID and display name
var filteredGroups = await graphClient.Groups
    .Request()
    .Filter("contains(displayName, 'Team')")
    .Select("id,displayName")
    .GetAsync();

Critical Pre-Requisite: Permissions

Don't forget: Your OpenID application needs the right permissions in AAD to read groups. You'll need to assign either Group.Read.All or Directory.Read.All application permissions (not delegated permissions) to your app in the Azure Portal. After assigning, make sure to grant admin consent for the permission — otherwise, your requests will return a 403 Forbidden error.

内容的提问来源于stack exchange，提问作者Seth