Question

我正在尝试在我的AD中添加新用户，但由于权限不足以完成操作而无法读取Azure Active Directory Graph API所需的权限（以下将不会出现此问题）时出现错误，这是我的代码段正在对AD Graph进行api调用

using Microsoft.Azure.ActiveDirectory.GraphClient;
using Microsoft.IdentityModel.Clients.ActiveDirectory;
using System;
using System.Collections.Generic;
using System.Configuration;
using System.Linq;
using System.Threading.Tasks;
using System.Web;


namespace AuthenticationPortal
{
    public class ActiveDirectoryClientModel
    {


        // These are the credentials the application will present during authentication
        // and were retrieved from the Azure Management Portal.
        // *** Don't even try to use these - they have been deleted.
        static string clientID = ConfigurationManager.AppSettings["ida:ClientId"];
        static string clientSecret = ConfigurationManager.AppSettings["ida:ClientSecret"];
        static string tenantId = ConfigurationManager.AppSettings["ida:TenantId"];
        static string domain = ConfigurationManager.AppSettings["ida:Domain"];
        // The Azure AD Graph API is the "resource" we're going to request access to.
        static string resAzureGraphAPI = "https://graph.windows.net";

        // This is the URL the application will authenticate at.
        static string authString = "https://login.microsoft.com/" + tenantId;

        // The Azure AD Graph API for my directory is available at this URL.
        static string serviceRootURL = "https://graph.windows.net/" + domain;

        private ActiveDirectoryClient GetAADClient()
        {
            try
            {
                Uri serviceroot = new Uri(serviceRootURL);
                ActiveDirectoryClient adClient = new ActiveDirectoryClient(serviceroot, async () => await GetAppTokenAsync());
                return adClient;
            }
            catch (Exception ex)
            {
                return null;
            }

        }

        private static async Task<string> GetAppTokenAsync()
        {
            try
            {
                // Instantiate an AuthenticationContext for my directory (see authString above).
                AuthenticationContext authenticationContext = new AuthenticationContext(authString, false);

                // Create a ClientCredential that will be used for authentication.
                // This is where the Client ID and Key/Secret from the Azure Management Portal is used.
                ClientCredential clientCred = new ClientCredential(clientID, clientSecret);

                // Acquire an access token from Azure AD to access the Azure AD Graph (the resource)
                // using the Client ID and Key/Secret as credentials.
                AuthenticationResult authenticationResult = await authenticationContext.AcquireTokenAsync(resAzureGraphAPI, clientCred);
                // Return the access token.
                return authenticationResult.AccessToken;
            }
            catch (Exception ex)
            {
                return null;
            }

        }


        public async Task CreateUser()
        {
            var adClient =  GetAADClient();

            var newUser = new User()
            {
                // Required settings
                DisplayName = "Atul Gandhale",
                UserPrincipalName = "atulm@"+ domain,
                PasswordProfile = new PasswordProfile()
                {
                    Password = "Asdf1234!",
                    ForceChangePasswordNextLogin = true
                },
                MailNickname = "atulg",
                AccountEnabled = true,

                // Some (not all) optional settings
                GivenName = "Atul",
                Surname = "Gandhale",
                JobTitle = "Programmer",
                Department = "Development",
                City = "Pune",
                State = "MH",
                Mobile = "1234567890",
            };
            try
            {
                // Add the user to the directory

                adClient.Users.AddUserAsync(newUser).Wait();
            }
            catch (Exception ex)
            {

            }
        }

    }

}

请帮我，我已经发送了几个小时，但无法获得解决方案。