Microsoft-Graph

How an AI agent reaches Microsoft Graph as the signed-in user through MCP — why token passthrough fails, and how on-behalf-of, Conditional Access, and RBAC secure the chain.

Every Microsoft integration I have shipped starts at the same gate. Call the Graph API, wire up SharePoint, add “Sign in with Microsoft” to an app, and none of it works until you have an App Registration. Get it wrong and nothing downstream authenticates, which is why this is the one setup step I slow down for instead of clicking through.

Introduction # Storing files in SharePoint from a .NET service sounds like it should be a solved problem, and it is, as long as you make one decision early: delegated or application permissions. That single choice changes who shows up as “Created by” on every file and whether your service needs a signed-in user at all. Get it wrong and you rebuild the auth layer later.