MS Graph InteractiveBrowserCredential , Is a Client ID registered in Azure Portal really necessary?

Question

I work with an organization that has a MS 365 tenant. We have Dot Net applications that currently use a different authentication scheme, and we want to rework them to authenticate against MS 365. Due to our organizational structure, we don't have access to the Azure Portal so getting a client id for my application(s) requires reaching out far beyond my department.

I have done some experiments with MS Graph, and I am able to authenticate and get enough profile information to do what I need to do. But I'm doing all that without a client id. Everything I'm able to find says that this method is acceptable for development but not production, but I still don't fully understand why. Am I creating some security risk? For the tenant? Other applications?

I don't need to access or manipulate anything in the tenant, I would just take something like 'mail' or 'UPN' and authorize against an internal database for access.

Anyone comments or advise is appreciated. Here is the basic code that works for me.

    static async Task<GraphServiceClient> CreateGraphClient()
    {
        // Create an instance of the GraphServiceClient using Azure Identity
        var options = new TokenCredentialOptions
        {
            AuthorityHost = AzureAuthorityHosts.AzurePublicCloud
        };
        var ibcOptions = new InteractiveBrowserCredentialOptions();
        ibcOptions.TenantId = "xxxx";
        ibcOptions.DisableAutomaticAuthentication = true;
        var interactiveBrowserCredential = new InteractiveBrowserCredential( ibcOptions );
        var result = interactiveBrowserCredential.Authenticate();
        var graphServiceClient = new GraphServiceClient(interactiveBrowserCredential);
        return graphServiceClient;
    }

Answer 1

Note that: Client ID is necessary to authenticate your app with Microsoft Entra ID and access Microsoft Graph API.

• Yes, it is possible to authenticate and get profile information without a client ID, but not recommended for production use.
• Without a client ID, it is using the default client ID. This means that you may be creating a security risk for your organization by allowing unauthorized access to your tenant.

Hence obtain a client ID for the Microsoft Entra ID application by registering it with User.Read delegated Microsoft Graph API permission to get the signed in user details:

Add http://localhost as redirect URL in Mobile and desktop applications platform and enable mobile and desktop flows as YES:

Modify the code to pass the ClientID of the Microsoft Entra ID application and to fetch the user details:

public class GraphClientHelper
{
    public static async Task<GraphServiceClient> CreateGraphClientAsync()
    {
        try
        {
            var options = new TokenCredentialOptions
            {
                AuthorityHost = AzureAuthorityHosts.AzurePublicCloud
            };

            var ibcOptions = new InteractiveBrowserCredentialOptions
            {
                TenantId = "TenantID", 
                ClientId = "ClientID", // Replace with your Client ID
                DisableAutomaticAuthentication = false, 
                RedirectUri = new Uri("http://localhost") 
            };

            var interactiveBrowserCredential = new InteractiveBrowserCredential(ibcOptions);
            var graphServiceClient = new GraphServiceClient(interactiveBrowserCredential, new[] { "User.Read" });
            return graphServiceClient;
        }
        catch (AuthenticationFailedException ex)
        {
            Console.WriteLine($"Authentication failed: {ex.Message}");
            throw;
        }
        catch (Exception ex)
        {
            Console.WriteLine($"An error occurred: {ex.Message}");
            throw;
        }
    }
}

public class Program
{
    public static async Task Main(string[] args)
    {
        try
        {
            var graphClient = await GraphClientHelper.CreateGraphClientAsync();

            var user = await graphClient.Me.GetAsync();
            Console.WriteLine($"User: {user.DisplayName}, Email: {user.Mail}");
        }
        catch (Exception ex)
        {
            Console.WriteLine($"An error occurred: {ex.Message}");
        }
    }
}

Reference:

Choose a Microsoft Graph authentication provider - Microsoft Graph | Microsoft