This sample application backs one or more technical articles on learn.microsoft.com.

This sample shows how a Python console application can access a protected API, as its own identity, using the Microsoft Authentication Library (MSAL) for Python. This scenario supports usages such as cron jobs and also direct command line invocation.

$ python3 cli.py
Could not find a cached token, so fetching a new one.
Graph API call result: {
  "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#applications/$entity",
  "id": "00aa00aa-bb11-cc22-dd33-44ee44ee44ee",
  "deletedDateTime": null,
  "appId": "00001111-aaaa-2222-bbbb-3333cccc4444",
  "applicationTemplateId": null,
  "disabledByMicrosoftStatus": null,
  "createdDateTime": "2021-01-17T15:30:55Z",
  "displayName": "python-cli",
  "description": null,
  "groupMembershipClaims": null,
  ...
}

• A Microsoft Entra tenant and the permissions or role required for managing app registrations in the tenant.
• Python 3

First, complete the steps in Register an application with the Microsoft identity platform to register the application.

Use these settings in your app registration.

ℹ️ Bold text in the tables above matches (or is similar to) a UI element in the Microsoft Entra admin center, while code formatting indicates a value you enter into a text box in the Microsoft Entra admin center.

In cli.py, update each variable with values from the app registration you created in the previous step.

# Full directory URL, in the form of https://login.microsoftonline.com/<tenant_id>
"authority": "https://login.microsoftonline.com/Enter_the_Tenant_ID_Here",
# Application (client) ID of app registration in the Microsoft Entra admin center - this value is a GUID
"client_id": "Enter_the_Application_Id_Here",
# Client secret 'Value' (not its ID) from 'Client secrets' in the Microsoft Entra admin center
"client_secret": "Enter_the_Client_Secret_Value_Here",
# Client 'Object ID' of app registration in the Microsoft Entra admin center - this value is a GUID
"client_objectid": "Enter_the_Client_Object_ID_Here",

Install MSAL and other required packages:

pip install -r requirements.txt

python3 cli.py

If everything worked, you should receive a response similar to this (output truncated for brevity):

Could not find a cached token, so fetching a new one.
Graph API call result: {
  "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#applications/$entity",
  "id": "00aa00aa-bb11-cc22-dd33-44ee44ee44ee",
  "deletedDateTime": null,
  "appId": "00001111-aaaa-2222-bbbb-3333cccc4444",
  "applicationTemplateId": null,
  "disabledByMicrosoftStatus": null,
  "createdDateTime": "2021-01-17T15:30:55Z",
  "displayName": "python-cli",
  "description": null,
  "groupMembershipClaims": null,
  ...
}

This Python application uses a client secret as its credentials to retrieve an access token that's scoped specifically for the Microsoft Graph API, and then uses that token to access its own application registration information.

If you can't get the sample working, you've checked Stack Overflow, and you've already searched the issues in this sample's repository, open an issue report the problem.

1. Search the GitHub issues in the repository - your problem might already have been reported or have an answer.
2. Nothing similar? Open an issue that clearly explains the problem you're having running the sample app.

⚠️ WARNING: Any issue in this repository not limited to running one of its sample apps will be closed without being addressed. For all other requests, see [Support and help options for developers | Microsoft identity platform](For all other requests, see Support and help options for developers. ).

If you'd like to contribute to this sample, see CONTRIBUTING.MD.

This project has adopted the Microsoft Open Source Code of Conduct. For more information, see the Code of Conduct FAQ or contact opencode@microsoft.com with any additional questions or comments.