Microsoft Security Platform

| Parameter | Type | Required | Description | |---|---|---:|---| | tenant | string | Yes | Entra tenant identifier in the URL. | | client_id | string | Yes | Application registration ID. | | client_secret | string | Yes for confidential clients | Secret value; store in Key Vault or another protected secret store. | | grant_type | string | Yes | client_credentials for app-only access; authorization_code for delegated access. | | scope | string | Yes | API permission target. Use {resource}/.default for client credentials. | | code | string | Conditional | Authorization code returned by the sign-in endpoint. | | redirect_uri | string | Conditional | Must match the registered redirect URI for authorization-code redemption. |

Code Example

The following Python example requests an app-only Microsoft Graph token. The application must have admin-consented application permissions, such as SecurityEvents.Read.All.

`python import os import requests

tenant = os.environ["ENTRA_TENANT_ID"] data = { "client_id": os.environ["ENTRA_CLIENT_ID"], "client_secret": os.environ["ENTRA_CLIENT_SECRET"], "grant_type": "client_credentials", "scope": "https://graph.microsoft.com/.default", }

url = f"https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token" response = requests.post(url, data=data, timeout=30) response.raise_for_status()

token = response.json()["access_token"] headers = {"Authorization": f"Bearer {token}"}

security_response = requests.get( "https://graph.microsoft.com/v1.0/security/alerts_v2", headers=headers, timeout=30, ) security_response.raise_for_status() print(security_response.json()) `

Response Format

A successful token response contains an opaque access token and its lifetime.

json { "token_type": "Bearer", "expires_in": 3599, "ext_expires_in": 3599, "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9..." }

• token_type: Authentication scheme; send Bearer. - expires_in: Lifetime in seconds. - ext_expires_in: Extended lifetime value returned by Entra ID. - access_token: Token for the requested resource; do not log it.

Notes & Best Practices

• A 401 usually indicates an invalid, expired, or wrong-resource token. A 403 commonly indicates missing admin consent, application permission, or delegated permission. - Cache tokens until shortly before expires_in; do not request a new token for every API call. - Client credentials requires /.default and uses permissions already configured on the app registration; it does not request individual scopes dynamically. - Validate aud, iss, tid, and roles for app-only tokens, or scp for delegated tokens, when inspecting JWTs during diagnostics. Keep token acquisition, permission consent, and API calls as separate Token Ladder stages.

End of chapter one. 39 more chapters in the full book.