Introduction

Accessing Microsoft 365 data (SharePoint, Outlook, Teams, or OneDrive) through a client application involves securely authenticating to Microsoft Entra ID (Azure AD) and requesting tokens to call APIs like Microsoft Graph or SharePoint REST.

This article explains:

Authentication Models

Before a client application can access Microsoft 365 services (like SharePoint, OneDrive, Teams, or Outlook), it must first authenticate. There are two main models of authentication for client applications:

1. Delegated (User) Authentication

Example:
A SharePoint client app that reads the logged-in user’s documents in OneDrive.

2. Application (App-Only) Authentication

Example:
A service that automatically archives emails from all user mailboxes in an organization.

When Do You Need Tokenization and App Registration?

You need App Registration and Tokens when

ScenarioReason
Client or Console App (Python, C#, Node.js)You must register your app in Entra ID to get a Client ID and Secret/Certificate to authenticate.
Custom Web App connecting to Microsoft GraphWeb apps outside Microsoft 365 need tokens to prove identity and permissions.
Background/Migration Tools (App-Only)Need tenant-wide access, require Sites.Read.All or Sites.FullControl.All.
Service Accounts replaced by Modern AuthToken-based auth replaces legacy username-password.
PowerShell Graph scripts (using MSAL)Each script authenticates via an app registration or managed identity.

You do not need App Registration or Tokens when

ScenarioWhy
SPFx (SharePoint Framework) web parts or extensionsSPFx runs within the SharePoint security context, automatically using the user’s existing Azure AD session.
Graph calls made via MSGraphClient or AadHttpClient in SPFxThese clients use SharePoint’s pre-registered Azure AD application. No manual registration or secrets are needed.
Power Automate / Power AppsTokens are handled internally by Microsoft’s Power Platform identity layer. You simply grant permissions via connectors.
SharePoint Add-ins (legacy model)Add-ins are registered in SharePoint directly and use the built-in OAuth trust (not Entra ID registration).
Screenshot 2025-10-15 210003

Example
If you’re building an SPFx web part that fetches user profile data via Microsoft Graph (/me endpoint), you just use:

this.context.msGraphClientFactory
  .getClient()
  .then((client) => {
    client
      .api('/me') // Current user
      .get()
      .then((response) => {
        console.log('User details:', response);
      })
      .catch((error) => {
        console.error('Error fetching user:', error);
      });
  });

No manual token, no app registration, no consent prompt for end-users.

But, if you use a Python script or any client application to access the Microsoft 365 service, like a SharePoint Site or List detail or User Information, you need to use an access token.

Steps to Register an App in Azure AD (for Client Access)

  1. Go to Azure Portal → App Registrations → New Registration

Screenshot 2025-10-15 205702

  1. Provide App Name, select Accounts in this organization only

  2. Note down Application (Client) ID and Directory (Tenant) ID

  3. Under Certificates & Secrets, generate a Client Secret

  4. Under API Permissions, add:

    • User.Read (delegated, for sign-in)

    • Sites.Read.All (delegated or app-only, to access SharePoint)

Screenshot 2025-10-15 205804

  1. Click Grant admin consent (if required)

  2. Use the MSAL library to request tokens in your app

Below is the Python script to get the user details

import msal
import requests

# Azure AD App details
TENANT_ID = 'YOUR_TENANT_ID'
CLIENT_ID = 'YOUR_CLIENT_ID'
CLIENT_SECRET = 'YOUR_CLIENT_SECRET'

# Microsoft Graph endpoint
AUTHORITY = f"https://login.microsoftonline.com/{TENANT_ID}"
SCOPE = ["https://graph.microsoft.com/.default"]
GRAPH_ENDPOINT = "https://graph.microsoft.com/v1.0/me"

# Create a confidential client (for daemon or service apps)
app = msal.ConfidentialClientApplication(
    CLIENT_ID,
    authority=AUTHORITY,
    client_credential=CLIENT_SECRET
)

# Acquire token
result = app.acquire_token_for_client(scopes=SCOPE)

if "access_token" in result:
    headers = {"Authorization": f"Bearer {result['access_token']}"}
    response = requests.get(GRAPH_ENDPOINT, headers=headers)

    if response.status_code == 200:
        user = response.json()
        print("User Details:")
        print(f"Display Name: {user.get('displayName')}")
        print(f"Email: {user.get('mail')}")
        print(f"Job Title: {user.get('jobTitle')}")
    else:
        print("Error:", response.status_code, response.text)
else:
    print("Error acquiring token:", result.get("error_description"))

Summary

Access TypeRequires App RegistrationRequires Admin ConsentTypical Use Case
SPFx (user context)NoNoUI components in SharePoint
Python / API client (delegated)YesSometimesEnd-user tools or scripts
App-only (background/migration)YesYesAutomation, migration
Power Automate / Power AppsNoManaged by MicrosoftBusiness process apps

Key Takeaway