An introduction to Microsoft Graph for developers

Editor's Notes

• #3: https://www.youtube.com/watch?v=EBbnpFdB92A
• #5: With Microsoft Graph, apps and services can leverage this incredibly rich data set from M365 thanks to the Microsoft Graph service, which directs the calls to the right source so developer don’t need to know where exactly the data lives. Graph also aggregates calls for efficiency and performance, and allows the developer to easily traverse the graph of data. This way, it’s easy to build an app that – for example – based on a security alert in a tenant, can traverse the graph to see which users might be affected, and for each user, which devices and documents might be affected – thus making it easy to connect data from across many services to solve for real business scenarios. And some of these scenarios include : building apps for identity-centric scenarios - where users, and other AAD-centric and directory data is at the center – for example, like pulling in who is someone's manager or what organization they are in. Devs can build apps with richer content – Access deep insights generated from usage patterns, such as trending documents, best team meeting times, or who people typically work with. Devs can also build apps with deep insights based on machine learning algorithms that power some of the Graph APIs. And finally devs can build apps with real time updates of the data – for businesses that run in real time. Developers can respond to changes in Microsoft Graph data in real time. For example, reschedule a meeting based on responses, notify others when a file is modified, or continue a process after it's been approved. We’re super excited to make Microsoft Graph the gateway to data and intelligence in Microsoft 365 and give developers a unified programmability model to take advantage of the tremendous amount of data in Office 365, Enterprise Mobility + Security, and Windows 10. And we’ve also recently added Dynamics 365 Business Central data in Microsoft Graph.
• #7: Demos with graph explorer: Prep: Navigate to https://graph.microsoft.io/graphd-explorer Sign in and consent if prompted In the txt box type the requests bellow to showcase the API Click GO or press enter to execute the request and see the API call results. Demo Intro: This is a web application built for showcasing requests and responses of Microsoft Graph hosted under graph.microsoft.com. I’m logged in to this application using my credentials and I will show you how using this single endpoint I can access data across services in Office 365 and Azure. Requests: /ME Talking point: graph.microsoft.com is an API that aggregates information across services. Starting with the user, I can make request to get my profile using the shortcut /me. This requests goes and gets my basic profile information from Azure AD, my picture from Exchange and my extended profile from SharePoint, like my interests and skills https://graph.microsoft.com/v1.0/me https://graph.microsoft.com/v1.0/me/userPhoto https://graph.microsoft.com/v1.0/me?$select=skills /USERS Talking point: in a similar fashion I can get the same information for other users in my organization, including organizational structure https://graph.microsoft.com/v1.0/me/manager https://graph.microsoft.com/v1.0/me/directReports https://graph.microsoft.com/v1.0/me/memberOf https://graph.microsoft.com/v1.0/users https://graph.microsoft.com/v1.0/users?$filter=Department eq ‘Extensibility’ https://graph.microsoft.com/v1.0/users/[email protected] https://graph.microsoft.com/v1.0/users/[email protected]/manager /MESSAGES and /EVENTS Talking point: using the same endpoint I can get access to my messages and calendar from Exchange https://graph.microsoft.com/v1.0/me/messages?$top=5 https://graph.microsoft.com/v1.0/me/messages?$skip=5&$orderBy=DateTimeCreated https://graph.microsoft.com/v1.0/me/messages?$search=”from:dan” --- Use CTRL+F to use browser search to find Dan https://graph.microsoft.com/v1.0/me/events https://graph.microsoft.com/v1.0/me/events?$top5 /FILES Talking point: and files from OneDrive for Business. Furthermore, I can navigate to a particular file and see the profile of the last person who modified it https://graph.microsoft.com/v1.0/me/drive/root/children https://graph.microsoft.com/v1.0/me/drive/root/children/file.txt https://graph.microsoft.com/v1.0/me/drive/items/<id> https://graph.microsoft.com/v1.0/me/drive/items/<id>/lastModifiedByUser https://graph.microsoft.com/v1.0/[email protected]/drive/root https://graph.microsoft.com/v1.0/[email protected]/drive/items/<id>/lastModifiedByUser/manager /GROUPS Talking point: Microsoft Graph is also the API front for Office 365 Groups, where users can collaborate and have conversations, shared calendar and shared files. Using graph.microsoft.com is the way to go to access all of the group’s information, for both management and content. Information groups is coming from multiple services, including AAD, SharePoint and Exchange and growing to OneNote and others. https://graph.microsoft.com/v1.0/groups https://graph.microsoft.com/v1.0/groups?$filter=groupType eq ‘Unified’ https://graph.microsoft.com/v1.0/groups/<id> – Select a unified group on ID https://graph.microsoft.com/v1.0/groups /<id>/members https://graph.microsoft.com/v1.0/groups/<id>/drive/root/children https://graph.microsoft.com/v1.0/groups/<id>/conversations https://graph.microsoft.com/v1.0/groups/<id>/events /TRENDINGAROUND and /PEOPLE Talking point: Now, I think you have all heard about our intelligent services and the insight and relationships that we calculate based on user activity in the service. Microsoft Graph exposes those APIs as well. Here is where we take all of the data across Office 365 services and the signals collected based on user’s activity, and combine them and process them through a whole bunch of machine learning, relevance and ranking algorithms that return inferred and calculated insights and relationships between entities. These relationships between people, content and interactions that occur across Office 365. https://graph.microsoft.com/beta/me/people https://graph.microsoft.com/beta/me/trendingAround /WORKBOOK – EXCEL API Talking point: Do you need to calculate, analyze, automate, report on or manage data in your app? Well, look no further at building these capabilities yourself – using the new Excel REST API, you have the power and simplicity of Excel at your fingertips (or a few simple HTTP calls) for all of your app’s calculation needs. https://graph.microsoft.com/v1.0/me/drive/root:/bool.xlsx:/workbook/worksheets('Sheet1') PATCH https://graph.microsoft.com/v1.0/me/drive/root:/bool.xlsx:/workbook/worksheets('Sheet1')/range(address='A1:A6')/format/fill { color: "#FF0000" }      
• #13: Microsoft Tech Summit FY17
• #21: Get a free Azure AD tenant for development purposes https://aka.ms/o365devprogram The Code from previous session: https://gist.github.com/kalyankrishna1/0a6ea6d00a09f7ae81c89960e1038d79 For Change notifications, we’d use the following sample, please download: https://github.com/microsoftgraph/msgraph-training-changenotifications We’d use ngrok to demo notifications. Register and download the free tool from : https://ngrok.com/ The updated code for this session: https://gist.github.com/kalyankrishna1/997f7ca1af1f73f8107c1c8cebfbaf3f
• #24: Application model How this works – what’s an application, service principal, permissions, consent
• #28: Embedded collections can be paginated too. Different APIs might have different default and maximum page sizes. Different APIs might behave differently if you specify a page size (via the $top query parameter) that exceeds the maximum page size for that API. Depending on the API, the requested page size might be ignored, it might default to the maximum page size for that API, or Microsoft Graph might return an error. Not all resources or relationships support paging. For example, queries against directoryRoles do not support paging. This includes reading role objects themselves as well as role members.
• #34: For some operations, such as PUT and PATCH (and in some cases POST), if your application doesn't need to make use of a response payload, you can ask the API to return minimal data. Note that some services already return a 204 No Content response for PUT and PATCH operations. Note: Request minimal representation responses using an HTTP request header where appropriate: Prefer: return=minimal. Note that for creation operations, this might not be appropriate because your application may expect to get the service generated id for the newly created object in the response.
• #37: https://graph.microsoft.com/v1.0/groups/delta?$select=displayName,description&$expand=members The delta function. A state token (deltaToken or skipToken) from the previous GET delta function call. The application begins by calling a GET request with the delta function on the desired resource. Microsoft Graph sends a response containing the requested resource and a state token. a. If a nextLink URL is returned, there may be additional pages of data to be retrieved in the session. The application continues making requests using the nextLink URL to retrieve all pages of data until a deltaLink URL is returned in the response. b. If a deltaLink URL is returned, there is no more data about the existing state of the resource to be returned. For future requests, the application uses the deltaLink URL to learn about changes to the resource. When the application needs to learn about changes to the resource, it makes a new request using the deltaLink URL received in step 2. This request may be made immediately after completing step 2 or when the application checks for changes. Microsoft Graph returns a response describing changes to the resource since the previous request, and either a nextLink URL or a deltaLink URL.
• #41: https://docs.microsoft.com/en-us/graph/api/subscription-post-subscriptions?view=graph-rest-1.0&tabs=http
• #45: Webhooks are HTTP requests made from Microsoft Graph to a web endpoint that you configure when creating the subscription. The endpoint uses HTTPS protocol, the endpoint must be publicly accessible (you cannot register an endpoint that is non-routable or behind a firewall such as https://localhost). During testing you can use a proxy such as ngrok.
• #46: https://docs.microsoft.com/en-us/graph/api/subscription-post-subscriptions?view=graph-rest-1.0&tabs=http
• #47: Your application sends an HTTP POST to the Microsoft graph endpoint https://graph.microsoft.com/v1.0/subscriptions/ Microsoft sends an HTTP POST to the URL with a queryString ?validationToken. Your application has 10 seconds to reply with a 200 OK and the token in the response body. If your API replies within the 10 seconds, the response to the original request is finally sent back to the application Finally, your API will receive notifications for the given resource for the duration of the subscription, your application needs to update the subscription request prior to the timeout. When your application receives a notification, it can then make a request back to Microsoft Graph to request additional information about the changed resource. The initial subscription request includes a client state, which should be matched against the client state value sent from Microsoft. Your API has about 10 seconds to reply to a notification with an HTTP 202 before Microsoft will re-send the request.
• #48: The changeType, notificationUrl, resource, and expirationDateTime properties are required. See subscription resource type for property definitions and values. The resource property specifies the resource that will be monitored for changes. For example, you can create a subscription to a specific mail folder: me/mailFolders('inbox')/messages or on behalf of a user given by an administrator consent: users/[email protected]/mailFolders('inbox')/messages. Although clientState is not required, you must include it to comply with our recommended notification handling process. Setting this property will allow you to confirm that notifications you receive originate from the Microsoft Graph service. For this reason, the value of the property should remain secret and known only to your application and the Microsoft Graph service.
• #49: The changeType, notificationUrl, resource, and expirationDateTime properties are required. See subscription resource type for property definitions and values. The resource property specifies the resource that will be monitored for changes. For example, you can create a subscription to a specific mail folder: me/mailFolders('inbox')/messages or on behalf of a user given by an administrator consent: users/[email protected]/mailFolders('inbox')/messages. Although clientState is not required, you must include it to comply with our recommended notification handling process. Setting this property will allow you to confirm that notifications you receive originate from the Microsoft Graph service. For this reason, the value of the property should remain secret and known only to your application and the Microsoft Graph service.
• #55: While your application should handle all error responses (in the 400 and 500 ranges), some special attention should be paid to certain expected errors and responses, which are highlighted below.
• #57: JSON batching allows you to optimize your application by combining multiple requests into a single JSON object. For example, a client might want to compose a view of unrelated data such as: An image stored in OneDrive A list of Planner tasks The calendar for a group Batch requests are always sent using POST to the /$batch endpoint. Batch size is limited to 20
• #59: Important: You should not use extensions to store sensitive personally identifiable information, such as account credentials, government identification numbers, cardholder data, financial account data, healthcare information, or sensitive background information.
• #62: Open extensions (formerly known as Office 365 data extensions) are open types that offer a flexible way to add untyped app data directly to a resource instance.
• #63: CRUD operations are supported
• #69: CRUD operations are supported The same permissions that are required to read from or write to a specific resource are also required to read from or write to any extensions data on that resource. Additionally, to create and manage schema extension definitions, an application must be granted the Directory.AccessAsUser.All permission.
• #82: One more way of looking at what Microsoft Graph has to offer is by looking at the resources is exposes These services and the suite of products behind them, have core entities that drive user productivity and the one of the first steps on my journey to serve you as a developer is to expose these core entities in a coherent and consistent form so that you can interact with them and use them in your tailored solutions.