How do I get a Graph API token with higher permission than the user?

Question

I am currently developing a Microsoft Teams tab app using Teams Toolkit.

The users of the app should be able to invite guest users to certain teams and edit some of the users information in AD. This requires higher permission level than the users have.

I have tried to use delegated permission but this limits the permission of the app based on the user's permissions. See https://learn.microsoft.com/en-us/graph/auth/auth-concepts

Is there a way using Teams Toolkit or, as a last resort, some other package to get a Graph API token that will allow the app to perform operations that requires permissions higher that what the user have?

For reference I list below some of the permission the app needs:

        "User.ReadBasic.All",
        "Sites.ReadWrite.All",
        "Domain.ReadWrite.All",
        "Directory.ReadWrite.All",
        "TeamMember.ReadWrite.All",
        "TeamSettings.ReadWrite.All",

Thank you!

Answer 1

Just as Hilton mentioned, you should use "Application" permission for your scenario.

"Application" permission is designed to running from backend, so you can setup a backend web app or Azure Function to do this.

Here are the basic steps:

1. Go to your AAD app, and add the permission you want

2. Consent the permission

3. copy client id and client secret from AAD portal

4. Follow the steps to get access token https://learn.microsoft.com/en-us/graph/auth-v2-service#4-get-an-access-token

By the way, recommend to use Azure Function features inside Teams Toolkit, which can help you easily setup an Azure Function in you Teams Tab project, then you can write the code inside the Azure Function to call graph api with application permission