microsoftgraph
diff --git a/.gitignore b/.gitignore
@@ -7,6 +7,7 @@ release.properties
 dependency-reduced-pom.xml
 buildNumber.properties
 .mvn/timing.properties
+bin/
 
 # Avoid ignoring Maven wrapper jar file (.jar files are usually ignored)
 !/.mvn/wrapper/maven-wrapper.jar
@@ -15,3 +16,4 @@ buildNumber.properties
 .vscode/
 
 oauth.properties
+*.zip
diff --git a/demo/README.md b/demo/README.md
@@ -4,48 +4,121 @@
 
 To run the completed project in this folder, you need the following:
 
-- [Java SE Development Kit (JDK)](https://java.com/en/download/faq/develop.xml) and [Gradle](https://gradle.org/) installed on your development machine. If you do not have the JDK or Gradle, visit the previous links for download options. (**Note:** This tutorial was written with OpenJDK version 14.0.0.36 and Gradle 6.7.1. The steps in this guide may work with other versions, but that has not been tested.)
+- [Java SE Development Kit (JDK)](https://java.com/en/download/faq/develop.xml) and [Gradle](https://gradle.org/) installed on your development machine. (**Note:** This tutorial was written with OpenJDK version 17.0.2 and Gradle 7.4.2. The steps in this guide may work with other versions, but that has not been tested.)
 - A Microsoft work or school account.
 
 If you don't have a Microsoft account, you can [sign up for the Microsoft 365 Developer Program](https://developer.microsoft.com/microsoft-365/dev-program) to get a free Microsoft 365 subscription.
 
-## Register a web application with the Azure Active Directory admin center
+## Register an application
 
-1. Open a browser and navigate to the [Azure Active Directory admin center](https://aad.portal.azure.com). Login using a **personal account** (aka: Microsoft Account) or **Work or School Account**.
+You can register an application using the Azure Active Directory admin center, or by using the [Microsoft Graph PowerShell SDK](https://docs.microsoft.com/graph/powershell/get-started).
+
+**NOTE:** If you downloaded this code from [https://developer.microsoft.com/graph/quick-start](https://developer.microsoft.com/graph/quick-start), an app registration has already been created for you. However, if you want to use the app-only portion of this sample, you will need to modify the app registration as specified in [Configure app-only auth (AAD admin center)](#configure-app-only-auth-aad-admin-center) or [Configure app-only auth (PowerShell)](#configure-app-only-auth-powershell).
+
+### Azure Active Directory admin center
+
+1. Open a browser and navigate to the [Azure Active Directory admin center](https://aad.portal.azure.com) and login using a **personal account** (aka: Microsoft Account) or **Work or School Account**.
 
 1. Select **Azure Active Directory** in the left-hand navigation, then select **App registrations** under **Manage**.
 
-    ![A screenshot of the App registrations ](/tutorial/images/aad-portal-app-registrations.png)
+1. Select **New registration**. Enter a name for your application, for example, `Java Graph Tutorial`.
+
+1. Set **Supported account types** as desired. The options are:
+
+    | Option | Who can sign in? |
+    |--------|------------------|
+    | **Accounts in this organizational directory only** | Only users in your Microsoft 365 organization |
+    | **Accounts in any organizational directory** | Users in any Microsoft 365 organization (work or school accounts) |
+    | **Accounts in any organizational directory ... and personal Microsoft accounts** | Users in any Microsoft 365 organization (work or school accounts) and personal Microsoft accounts |
+
+1. Leave **Redirect URI** empty.
+
+1. Select **Register**. On the application's **Overview** page, copy the value of the **Application (client) ID** and save it, you will need it in the next step. If you chose **Accounts in this organizational directory only** for **Supported account types**, also copy the **Directory (tenant) ID** and save it.
+
+1. Select **Authentication** under **Manage**. Locate the **Advanced settings** section and change the **Allow public client flows** toggle to **Yes**, then choose **Save**.
+
+#### Configure app-only auth (AAD admin center)
+
+> **Note:** This section requires a work/school account with the Global administrator role. You only need to complete these steps if you plan on using the app-only portions of this sample.
+
+1. Select **API permissions** under **Manage**.
+
+1. Remove the default **User.Read** permission under **Configured permissions** by selecting the ellipses (**...**) in its row and selecting **Remove permission**.
+
+1. Select **Add a permission**, then **Microsoft Graph**.
 
-1. Select **New registration**. On the **Register an application** page, set the values as follows.
+1. Select **Application permissions**.
 
-    - Set **Name** to `Java Graph Tutorial`.
-    - Set **Supported account types** to **Accounts in any organizational directory**.
-    - Leave **Redirect URI** empty.
+1. Select **User.Read.All**, then select **Add permissions**.
 
-    ![A screenshot of the Register an application page](/tutorial/images/aad-register-an-app.png)
+1. Select **Grant admin consent for...**, then select **Yes** to provide admin consent for the selected permission.
 
-1. Choose **Register**. On the **Java Graph Tutorial** page, copy the value of the **Application (client) ID** and save it, you will need it in the next step.
+1. Select **Certificates and secrets** under **Manage**, then select **New client secret**.
 
-    ![A screenshot of the application ID of the new app registration](/tutorial/images/aad-application-id.png)
+1. Enter a description, choose a duration, and select **Add**.
 
-1. Select the **Add a Redirect URI** link. On the **Redirect URIs** page, locate the **Suggested Redirect URIs for public clients (mobile, desktop)** section. Select the `https://login.microsoftonline.com/common/oauth2/nativeclient` URI.
+1. Copy the secret from the **Value** column, you will need it in the next steps.
 
-    ![A screenshot of the Redirect URIs page](/tutorial/images/aad-redirect-uris.png)
+### PowerShell
 
-1. Locate the **Default client type** section and change the **Treat application as a public client** toggle to **Yes**, then choose **Save**.
+To use PowerShell, you'll need the Microsoft Graph PowerShell SDK. If you do not have it, see [Install the Microsoft Graph PowerShell SDK](https://docs.microsoft.com/graph/powershell/installation) for installation instructions.
 
-    ![A screenshot of the Default client type section](/tutorial/images/aad-default-client-type.png)
+1. Open PowerShell and run the [RegisterAppForUserAuth.ps1](RegisterAppForUserAuth.ps1) file with the following command, replacing *&lt;audience-value&gt;* with the desired value (see table below).
+
+    > **Note:** The RegisterAppForUserAuth.ps1 script requires a work/school account with the Application administrator, Cloud application administrator, or Global administrator role.
+
+    ```powershell
+    .\RegisterAppForUserAuth.ps1 -AppName "Java Graph Tutorial" -SignInAudience <audience-value>
+    ```
+
+    | SignInAudience value | Who can sign in? |
+    |----------------------|------------------|
+    | `AzureADMyOrg` | Only users in your Microsoft 365 organization |
+    | `AzureADMultipleOrgs` | Users in any Microsoft 365 organization (work or school accounts) |
+    | `AzureADandPersonalMicrosoftAccount` | Users in any Microsoft 365 organization (work or school accounts) and personal Microsoft accounts |
+    | `PersonalMicrosoftAccount` | Only personal Microsoft accounts |
+
+1. Copy the **Client ID** and **Auth tenant** values from the script output. You will need these values in the next step.
+
+    ```powershell
+    SUCCESS
+    Client ID: 2fb1652f-a9a0-4db9-b220-b224b8d9d38b
+    Auth tenant: common
+    ```
+
+#### Configure app-only auth (PowerShell)
+
+> **Note:** This section requires a work/school account with the Global administrator role. You only need to complete these steps if you plan on using the app-only portions of this sample.
+
+1. Run the [UpdateAppForAppOnlyAuth.ps1](UpdateAppForAppOnlyAuth.ps1) file with the following command, replacing *&lt;your-client-id&gt;* with your client ID.
+
+    ```powershell
+    .\UpdateAppForAppOnlyAuth.ps1 -AppId <your-client-id> -GraphScopes "User.Read.All"
+    ```
+
+1. Copy the **Tenant ID** and **Client secret** values from the script output. You will need these values in the next step.
+
+    ```powershell
+    SUCCESS
+    Tenant ID: a795ad0f-7d82-4a3b-a2c0-0713ec72ade7
+    Client secret: 2jv7Q~8eiOd_QafJ.....
+    Secret expires: 2/16/2024 9:32:09 PM
+    ```
 
 ## Configure the sample
 
-1. Rename the `oAuth.properties.example` file to `oAuth.properties`.
-1. Edit the `oAuth.properties` file and make the following changes.
-    1. Replace `YOUR_APP_ID_HERE` with the **Application Id** you got from the App Registration Portal.
+1. Rename [oAuth.properties.example](./graphtutorial/app/src/main/resources/oAuth.properties.example) to `oauthProperties` and update the values according to the following table.
+
+    | Setting | Value |
+    |---------|-------|
+    | `app.clientId` | The client ID of your app registration |
+    | `app.clientSecret` | The client secret (only needed if doing app-only) |
+    | `app.tenantId` | The tenant ID of your organization (only needed if doing app-only) |
+    | `app.authTenant` | If you chose the option to only allow users in your organization to sign in, change this value to your tenant ID. Otherwise leave as `common`. |
 
 ## Build and run the sample
 
-In your command-line interface (CLI), navigate to the project directory and run the following commands.
+In your command-line interface (CLI), navigate to the project directory and run the following command.
 
 ```Shell
 ./gradlew --console plain run

diff --git a/demo/RegisterAppForUserAuth.ps1 b/demo/RegisterAppForUserAuth.ps1
@@ -0,0 +1,89 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT license.
+
+# <ScriptBody>
+param(
+  [Parameter(Mandatory=$true,
+  HelpMessage="The friendly name of the app registration")]
+  [String]
+  $AppName,
+
+  [Parameter(Mandatory=$false,
+  HelpMessage="The sign in audience for the app")]
+  [ValidateSet("AzureADMyOrg", "AzureADMultipleOrgs", `
+  "AzureADandPersonalMicrosoftAccount", "PersonalMicrosoftAccount")]
+  [String]
+  $SignInAudience = "AzureADandPersonalMicrosoftAccount",
+
+  [Parameter(Mandatory=$false)]
+  [Switch]
+  $StayConnected = $false
+)
+
+# Tenant to use in authentication.
+# See https://docs.microsoft.com/azure/active-directory/develop/v2-oauth2-device-code#device-authorization-request
+$authTenant = switch ($SignInAudience)
+{
+  "AzureADMyOrg" { "tenantId" }
+  "AzureADMultipleOrgs" { "organizations" }
+  "AzureADandPersonalMicrosoftAccount" { "common" }
+  "PersonalMicrosoftAccount" { "consumers" }
+  default { "invalid" }
+}
+
+if ($authTenant -eq "invalid")
+{
+  Write-Host -ForegroundColor Red "Invalid sign in audience:" $SignInAudience
+  Exit
+}
+
+# Requires an admin
+Connect-MgGraph -Scopes "Application.ReadWrite.All User.Read" -UseDeviceAuthentication -ErrorAction Stop
+
+# Get context for access to tenant ID
+$context = Get-MgContext -ErrorAction Stop
+
+if ($authTenant -eq "tenantId")
+{
+  $authTenant = $context.TenantId
+}
+
+# Create app registration
+$appRegistration = New-MgApplication -DisplayName $AppName -SignInAudience $SignInAudience `
+ -IsFallbackPublicClient -ErrorAction Stop
+Write-Host -ForegroundColor Cyan "App registration created with app ID" $appRegistration.AppId
+
+# Create corresponding service principal
+if ($SignInAudience -ne "PersonalMicrosoftAccount")
+{
+  New-MgServicePrincipal -AppId $appRegistration.AppId -ErrorAction SilentlyContinue `
+   -ErrorVariable SPError | Out-Null
+  if ($SPError)
+  {
+    Write-Host -ForegroundColor Red "A service principal for the app could not be created."
+    Write-Host -ForegroundColor Red $SPError
+    Exit
+  }
+
+  Write-Host -ForegroundColor Cyan "Service principal created"
+}
+
+Write-Host
+Write-Host -ForegroundColor Green "SUCCESS"
+Write-Host -ForegroundColor Cyan -NoNewline "Client ID: "
+Write-Host -ForegroundColor Yellow $appRegistration.AppId
+Write-Host -ForegroundColor Cyan -NoNewline "Auth tenant: "
+Write-Host -ForegroundColor Yellow $authTenant
+
+if ($StayConnected -eq $false)
+{
+  Disconnect-MgGraph
+  Write-Host "Disconnected from Microsoft Graph"
+}
+else
+{
+  Write-Host
+  Write-Host -ForegroundColor Yellow `
+   "The connection to Microsoft Graph is still active. To disconnect, use Disconnect-MgGraph"
+}
+# </ScriptBody>
diff --git a/demo/UpdateAppForAppOnlyAuth.ps1 b/demo/UpdateAppForAppOnlyAuth.ps1
@@ -0,0 +1,98 @@
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT license.
+
+# <ScriptBody>
+param(
+  [Parameter(Mandatory=$true,
+  HelpMessage="The app ID of the app registration")]
+  [String]
+  $AppId,
+
+  [Parameter(Mandatory=$true,
+  HelpMessage="The application permission scopes to configure on the app registration")]
+  [String[]]
+  $GraphScopes,
+
+  [Parameter(Mandatory=$false)]
+  [Switch]
+  $StayConnected = $false
+)
+
+$graphAppId = "00000003-0000-0000-c000-000000000000"
+
+# Requires an admin
+Connect-MgGraph -Scopes "Application.ReadWrite.All AppRoleAssignment.ReadWrite.All User.Read" `
+ -UseDeviceAuthentication -ErrorAction Stop
+
+# Get context for access to tenant ID
+$context = Get-MgContext -ErrorAction Stop
+
+# Get the application and service principal
+$appRegistration = Get-MgApplication -Filter ("appId eq '" + $AppId +"'") -ErrorAction Stop
+$appServicePrincipal = Get-MgServicePrincipal -Filter ("appId eq '" + $AppId + "'") -ErrorAction Stop
+
+# Lookup available Graph application permissions
+$graphServicePrincipal = Get-MgServicePrincipal -Filter ("appId eq '" + $graphAppId + "'") -ErrorAction Stop
+$graphAppPermissions = $graphServicePrincipal.AppRoles
+
+$resourceAccess = @()
+
+foreach($scope in $GraphScopes)
+{
+  $permission = $graphAppPermissions | Where-Object { $_.Value -eq $scope }
+  if ($permission)
+  {
+    $resourceAccess += @{ Id =  $permission.Id; Type = "Role"}
+  }
+  else
+  {
+    Write-Host -ForegroundColor Red "Invalid scope:" $scope
+    Exit
+  }
+}
+
+# Add the permissions to required resource access
+Update-MgApplication -ApplicationId $appRegistration.Id -RequiredResourceAccess `
+ @{ ResourceAppId = $graphAppId; ResourceAccess = $resourceAccess } -ErrorAction Stop
+Write-Host -ForegroundColor Cyan "Added application permissions to app registration"
+
+# Add admin consent
+foreach ($appRole in $resourceAccess)
+{
+  New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $appServicePrincipal.Id `
+   -PrincipalId $appServicePrincipal.Id -ResourceId $graphServicePrincipal.Id `
+   -AppRoleId $appRole.Id -ErrorAction SilentlyContinue -ErrorVariable SPError | Out-Null
+  if ($SPError)
+  {
+    Write-Host -ForegroundColor Red "Admin consent for one of the requested scopes could not be added."
+    Write-Host -ForegroundColor Red $SPError
+    Exit
+  }
+}
+Write-Host -ForegroundColor Cyan "Added admin consent"
+
+# Add a client secret
+$clientSecret = Add-MgApplicationPassword -ApplicationId $appRegistration.Id -PasswordCredential `
+ @{ DisplayName = "Added by PowerShell" } -ErrorAction Stop
+
+Write-Host
+Write-Host -ForegroundColor Green "SUCCESS"
+Write-Host -ForegroundColor Cyan -NoNewline "Tenant ID: "
+Write-Host -ForegroundColor Yellow $context.TenantId
+Write-Host -ForegroundColor Cyan -NoNewline "Client secret: "
+Write-Host -ForegroundColor Yellow $clientSecret.SecretText
+Write-Host -ForegroundColor Cyan -NoNewline "Secret expires: "
+Write-Host -ForegroundColor Yellow $clientSecret.EndDateTime
+
+if ($StayConnected -eq $false)
+{
+  Disconnect-MgGraph
+  Write-Host "Disconnected from Microsoft Graph"
+}
+else
+{
+  Write-Host
+  Write-Host -ForegroundColor Yellow `
+   "The connection to Microsoft Graph is still active. To disconnect, use Disconnect-MgGraph"
+}
+# </ScriptBody>
diff --git a/demo/graphtutorial/.classpath b/demo/graphtutorial/.classpath
diff --git a/demo/graphtutorial/.gitignore b/demo/graphtutorial/.gitignore
@@ -3,4 +3,3 @@
 
 # Ignore Gradle build output directory
 build
-bin/
Original file line number	Diff line number	Diff line change
Expand Up		@@ -3,4 +3,3 @@

		# Ignore Gradle build output directory
		build
		bin/