what are the latest approaches to call Graph api inside our automated flows

[johnjohnPter]

I want to initiate many api calls to graph api.. but not sure which connections we can use to do so, i find those 2 connections:-

1) Send HTTP Request, as follow:-

2) Invoke Http Request Preauthorized, as follow:-

so what are the differences between the 2 approaches? my main aim is to create a new Planner Plan , new Team Channel and show the Planner Plan as a tab inside the Team channel.. so which action best suites my needs and why?

Thanks

[ivan_apps]

From what I understand the HTTP with Microsoft Entra ID is for requests that live within your Azure tenant, and are able to connect via the Entra ID. It will allow you to pass your user ID for authentication in a couple fewer connections/authorizations. You will still need an app registration with the necessary permissions.  Common things this is good for is connecting to GraphAPI.

https://learn.microsoft.com/en-us/connectors/webcontents/

The other HTTP request is basically to make a request to any other outside resources that may have an API that doesn't recognize Entra ID.  This can do the same things as the other one, but you will have to configure the App Registration as well as the initial authentication separately.  I believe the difference here is that for governance reasons, a tenant admin may want to block the generic HTTP connection so users can't exfiltrate data.  However if you're simply connecting to local resources in the Azure tenant, then they can allow the HTTP with Entra ID connector.

[johnjohnPter]

@ivan_apps Thanks for the reply. but if we use the "HTTP with Microsoft Entra ID", then we do not have to register an app registration with the necessary permissions.. as you mentioned.. am i correct?

[ivan_apps]

No, sorry if it was confusing - you will still need an app registration with the appropriate permissions in Entra ID. That's what will still allow you to specify specific access rights so you don't over-permission a user.

[johnjohnPter]

@ivan_apps but i tested the Invoke Http request and i were able to create a test Planner Plan, without having to register an App on AD, i just login using the service account username/password, as follow:-

so do you mean the app registration will be done behind the scenes?

Thanks

[ivan_apps]

So with the preauthorized http action an app registration will be created behind the scenes and granted admin consent. Note that this has changed recently so the API permissions must be granted by an admin. Text below:

“With the existing connector, there is no need for administrators to explicitly grant consent for actions to be executed by the application on behalf of the user. However, we released a new version of this connector. The new version of the connector uses a new application without any preauthorization. This allows an administrator to grant discrete consent.”

so you’re good for now if you can do it, but know that in the future it may require explicit consent on the App Registration before it starts working.

[bwtwma]

The action doesn't work for me - would someone mind demoing how it is meant to be set up? The MSFT learn is useless.