Hi Kirill!

That long string you get back from the plugin is actually a JWT (JSON Web Token) and is essentially a hashed signature of the successful authentication. This needs to be validated by Microsoft. I chose to do this for security, although I may revisit this in future versions of the plugin once I understand how the black box of the MSAL library works behind the scenes better. In any case, once you get this string back from SignInUserSilent/SignInUserInteractive, send a GET request to 

https://graph.microsoft.com/v1.0/me

with one header

Authorization: <SignInUserSilent.JWT/SignInUserInteractive.JWT (that string you posted)>

You will get back an object that looks something like this:

{

  "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#users/$entity",

  "businessPhones": [

    "+12345678910"

  ],

  "displayName": "Robins, Walter",

  "givenName": "Walter",

  "jobTitle": "Developer",

  "mail": null,

  "mobilePhone": null,

  "officeLocation": null,

  "preferredLanguage": null,

  "surname": "Robins",

  "userPrincipalName": "wrobins@myemailaddr.com",

  "id": "myaccount-guid-1234"

}

You can use that to get your account information. Let me know if that helps you get started or if you have more questions!

Stay safe

Hi Walter,

Thank you for answer.

To do GET call I need to understand right place.

I guess that it can be in GetAccount action before deserialization. Because SignInUserSilent/SignInUserInteractive doesn't uses anywhere...

BR, Kirill

Afaik, proper call order would be:

MSALInit -> GetAccounts -> SignInUser[Interactive|Silent] -> Graph API (with JWT)

In other words, after you have verified user's identity, you can use that identity token to get user's authorizations/other profile info from Graph API.

Not directly related, but a heads-up:

string should be only Id and Username

This is true, but only if you initialize MSAL with accountmode "MULTIPLE". Iif MSAL is initialized with accountmode "SINGLE", return value for GetAccounts.Accounts will be a single item array ["account-guid"], which is serialized to empty list. This is not handled by default and deserialization to MSALAccountList will always return an empty list.

br,

-Mikko(N)