title: Microsoft Graph API Permissions for non-admins?
body: <p>I am trying to create a dropdown with all the users in my Office365 tenant. I created an app in Azure AD and gave it all the necessary permissions. I gave it all the permissions for Microsoft Graph actually, app and delegated. All of them.</p>
  
  <p>Then I wrote up my script to query all users with <code>https://graph.microsoft.com/v1.0/users</code>.</p>
  
  <p>I had my tenant admin go in and accept the permissions then output the list of users in the UI. Works fine for the admin</p>
  
  <p>I'm not an admin but when I go to the page I get the following error:</p>
  
  <blockquote>
    <p>This application requires application permissions to another
    application. Consent for application permissions can only be performed
    by an administrator. Sign out and sign in as an administrator or
    contact one of your organization's administrators.</p>
  </blockquote>
  
  <p>I need to know if this will work for users with even lower permissions. From what I understand the API request and the App is running under the permissions given to the application in Azure. So even if the user as Read Only, the request isn't running under the user, it's running under the Application I set up. So why would I get the error regarding permissions?</p>
  
  <p>This is the code I'm using: </p>
  
  <pre><code>(function () {
    "use strict";
    // Some samples will use the tenant name here like "tenant.onmicrosoft.com"
    // I prefer to user the subscription Id
    var subscriptionId = "metenant.onmicrosoft.com";
    // Copy the client ID of your AAD app here once you have registered one, configured the required permissions, and
    // allowed implicit flow https://msdn.microsoft.com/en-us/office/office365/howto/get-started-with-office-365-unified-api
    var clientId = "cccb1f2f-xxx-x-xxxxx-x-x-x-x-x-";
  
    window.config = {
      // subscriptionId: subscriptionId,
      clientId: clientId,
      postLogoutRedirectUri: window.location.origin,
      endpoints: {
        graphApiUri: 'https://graph.microsoft.com'
      },
      cacheLocation: 'localStorage' // enable this for IE, as sessionStorage does not work for localhost.
    };
  
    var authContext = new AuthenticationContext(config);
  
    // Check For &amp; Handle Redirect From AAD After Login
    var isCallback = authContext.isCallback(window.location.hash);
    authContext.handleWindowCallback();
  
    if (isCallback &amp;&amp; !authContext.getLoginError()) {
      window.location = authContext._getItem(authContext.CONSTANTS.STORAGE.LOGIN_REQUEST);
    }
  
    // If not logged in force login
    var user = authContext.getCachedUser();
    // NOTE: you may want to render the page for anonymous users and render
    // a login button which runs the login function upon click.
    if (!user) authContext.login();
  
    // Acquire token for Files resource.
    authContext.acquireToken(config.endpoints.graphApiUri, function (error, token) {
      // Handle ADAL Errors.
      if (error || !token) {
        console.log('ADAL error occurred: ' + error);
        return;
      }
      // Execute GET request to Files API.
      var filesUri = config.endpoints.graphApiUri + "/v1.0/users";
      $.ajax({
        type: "GET",
        url: filesUri,
        headers: {
          'Authorization': 'Bearer ' + token,
        }
      }).done(function (response) {
        console.log('Successfully fetched from Graph.');
        console.log(response);
  
        var container = $(".container")
  
        container.empty();
  
        $.each(response.value, function(index, item) {
          container.append($('&lt;li&gt;').text(item.displayName + " " + item.mail + " " + item.mobilePhone))
        })
      }).fail(function (response) {
        var err = JSON.parse(response.responseText)
        console.log('Failed:', err.error.message);
      });
    });
  })();
  </code></pre>