A perch-pond hatchery page completes MSAL sign-in but still receives HTTP 401 from Microsoft Graph. What step is missing?
Select an answer to reveal the explanation.
Short Explanation
Sign-in alone doesn’t feed Graph. You still need an access token aimed at Graph’s audience, then hang it on the request—SDK or REST.
Full Explanation
After interactive sign-in, clients must request an access token for Microsoft Graph (appropriate scopes such as User.Read) and send it as a bearer token on Graph SDK or REST calls. An ID token for the client application does not authorize Graph. Missing or wrong-audience tokens produce HTTP 401 from Graph.