title: Getting Access Token for Microsoft Graph from asp.net core Authentication web app
body: <p>I have an app which authenticates users against Azure AD as so:</p>
  
  <p>Startup.cs</p>
  
  <pre><code>using Microsoft.AspNetCore.Authentication.Cookies;
  
  public void ConfigureServices(IServiceCollection services)
  {
      services.AddMvc();
  
      services.AddAuthentication(
          SharedOptions =&gt; SharedOptions.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme);
  
      services.AddAuthorization(options =&gt;
      {
          //Auth Policies using group claims
      });
  }
  public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
  {
      //loggerFactory
  
      app.UseCookieAuthentication();
  
      app.UseOpenIdConnectAtuhentication(new OpenIdConnectOptions
      {
          ClientID = Configuration["Authentication:AzureAd:ClientId"],
          Authority = Configuration["Authentication:AzureAd:AADInstance"] + Configuration["Authentication:AzureAd:TenantId"],
          CallbackPath = Configuration["Authentication:AzureAd:CallbackPath"]
      });
  
      //Mvc Routing
  }
  </code></pre>
  
  <p>AccountController.cs</p>
  
  <pre><code> [HttpGet]
   public IActionResult SignIn()
   {
       return Challenge(
           new AuthenticationProperties { RedirectUri = "/" }, OpenIdConnectDefaults.AuthenticationScheme);
   }
  </code></pre>
  
  <p>On controllers I want to protect I then use <code>[Authorize(Policy = "Whatever")]</code></p>
  
  <p>All of that is working great, so my question is does the cookie I already have contain the token I need, and if so, do I simply access it with something like User.Claims or do I need the <code>IAuthenticationProvider</code> set up the way it was in the example for .net 4.6 <a href="https://github.com/microsoftgraph/aspnet-connect-sample" rel="nofollow noreferrer">Here</a>.</p>
  
  <p>And if it's the latter how do I do so without using Owin as they have?</p>
  
  <p>I should add that while Authorization is working fine, what I'd like to do now involves things like listing all users in an OU. For which, from what I can tell I'd have to access Microsoft Graph. Perhaps, I'm going in the complete wrong direction?</p>