Question: I am currently developing an Azure Web App with Python, it uses Azure AD Authentication for site access. I want to display the current users email (I plan to use this later for access tiers also). I saw a way to get the email through use of delegated GraphAPI to get the users details. I have attempted the way below: authority = f'https://login.microsoftonline.com/{subid}' scope = ["https://graph.microsoft.com/.default"] app = ConfidentialClientApplication( client_id, authority=authority, client_credential=client_secret ) token_response = app.acquire_token_for_client(scopes=scope) access_token = token_response['access_token'] headers = { 'Authorization': f'Bearer {access_token}' } response = requests.get('https://graph.microsoft.com/v1.0/me', headers=headers) user_data = response.json() print("~~~~~~~~~~~~~~~~~~~~~~") for key, value in user_data.items(): print(f'{key}: {value}') print("~~~~~~~~~~~~~~~~~~~~~~")  But this returns the error: error: {'code': 'BadRequest', 'message': '/me request is only valid with delegated authentication flow.', 'innerError': {'date': '2023-10-20T13:05:47', 'request-id': '9b6d8130-5bf6-4711-ba90-14ccaef0b127', 'client-request-id': '9b6d8130-5bf6-4711-ba90-14ccaef0b127'}}  I assume that delegated would work as a user needs to sign and be authenticated on azure to access the site, or am I missing something? Any help or alternative methods would be appreciated GraphAPI Permissions: 

Answer:  The error occurred as your code use client credentials flow for generating access token to call /me endpoint, which is not a delegated flow as it does not involve user interaction.  When I ran your code in my environment, I too got same error as below: import msal import requests authority = f'https://login.microsoftonline.com/tenantId' scope = ["https://graph.microsoft.com/.default"] client_id = "appId" client_secret = "secret" app = msal.ConfidentialClientApplication( client_id, authority=authority, client_credential=client_secret ) token_response = app.acquire_token_for_client(scopes=scope) access_token = token_response['access_token'] headers = { 'Authorization': f'Bearer {access_token}' } response = requests.get('https://graph.microsoft.com/v1.0/me', headers=headers) user_data = response.json() print("~~~~~~~~~~~~~~~~~~~~~~") for key, value in user_data.items(): print(f'{key}: {value}') print("~~~~~~~~~~~~~~~~~~~~~~")  Response:  To resolve the error, you need to switch to delegated flows like authorization code flow, interactive flow etc... that requires user to sign in for generating access token. In my case, I used interactive flow by enabling below option and added http://localhost as redirect URI in mobile/desktop platform:  When I ran the below modified python code, it asked me to pick an account to sign in: import msal import requests authority = f'https://login.microsoftonline.com/tenantId' scope = ["https://graph.microsoft.com/.default"] client_id = "appId" app = msal.PublicClientApplication( client_id, authority=authority, ) token_response = app.acquire_token_interactive(scopes=scope) access_token = token_response['access_token'] headers = { 'Authorization': f'Bearer {access_token}' } response = requests.get('https://graph.microsoft.com/v1.0/me', headers=headers) user_data = response.json() print("~~~~~~~~~~~~~~~~~~~~~~") for key, value in user_data.items(): print(f'{key}: {value}') print("~~~~~~~~~~~~~~~~~~~~~~")   While signing in, user will get consent screen to accept permissions as below:  After accepting the consent, I got the response with signed-in user details successfully in the output console like this: