01 / Application Registration
Registered a single-tenant application in Microsoft Entra ID and configured delegated Microsoft Graph permissions.
NOCTURNE SYSTEMS // NS-IAM-001
SECURING APPLICATION ACCESS
OAuth 2.0 · Microsoft Entra ID · Microsoft Graph
01 // EXECUTIVE SUMMARY
Project Overview
This project explored authentication and authorization using Microsoft Entra ID, OAuth 2.0, and Microsoft Graph.
I registered an application, implemented interactive authentication using Python and MSAL, acquired an access token, and tested Microsoft Graph API permissions.
The exercise demonstrated how access tokens and delegated permissions determine which resources an authenticated application can access.
02 // TECHNICAL WORKFLOW
Implementation & Testing
02 / OAuth Authentication
Developed a Python script using Microsoft Authentication Library (MSAL) to perform interactive authentication and obtain an access token.
03 / Microsoft Graph Integration
Used the acquired access token to call Microsoft Graph and retrieve the authenticated user profile.
04 / Authorization Testing
Tested access to a broader directory endpoint without sufficient delegated permissions and analyzed the resulting HTTP 403 response.
05 / JWT Analysis
Decoded the JWT payload locally and inspected audience, issuer, delegated scopes, and token expiration.
03 // TEST RESULTS
Authentication & Authorization
HTTP 200 // Authorized Microsoft Graph Request
Successfully called the Microsoft Graph /me endpoint using a delegated access token containing User.Read.
HTTP 403 // Insufficient Privileges
A request to the /users endpoint returned an authorization error because the token lacked the required broader directory permissions.
04 // SECURITY ANALYSIS
What Did This Demonstrate?
Authentication confirms the identity of the signed-in user, while authorization determines what the application can do.
A successful sign-in does not automatically authorize access to every Microsoft Graph endpoint. API access depends on the permissions represented by the token and the operation being requested.
JWT claims were decoded and inspected locally. Cryptographic signature verification was outside the scope of this exercise.
05 // EVIDENCE ARCHIVE
Full Technical Report
View the complete project documentation, including configuration details, authentication testing, authorization results, and sanitized screenshots.
06 // LESSONS LEARNED
Key Takeaways
This project strengthened my understanding of Microsoft Entra ID application registrations, OAuth authentication, delegated permissions, JWT claims, API authorization, and Microsoft Graph troubleshooting.
Authorized lab exercise. Sensitive authentication tokens, credentials, tenant identifiers, and personally identifying information are excluded from public documentation.