Demonstration code fails authentication - The provided request must include a 'client_secret' input parameter

[JeffreyEnglish]

Describe the bug

I am trying to run the sample code from the README.

import asyncio
from azure.identity import InteractiveBrowserCredential
from msgraph import GraphServiceClient

credential = InteractiveBrowserCredential(
    client_id="c4368f6a-49b2-4219-8a57-76249566c5fd",
    tenant_id="consumers",
)
scopes = ["User.Read"]
client = GraphServiceClient(credentials=credential, scopes=scopes,)

# GET /me
async def me():
    me = await client.me.get()
    if me:
        print(me.display_name)
asyncio.run(me())

After logging in in the browser, get the error message:

azure.core.exceptions.ClientAuthenticationError: Authentication failed: AADSTS70002: The provided request must include a 'client_secret' input parameter. Trace ID: 503dcd2c-650c-4577-b1e7-2ce1a5cb1e01 Correlation ID: 5b1f4951-27ce-4edc-8f9a-81fe695002d8 Timestamp: 2025-02-24 22:39:43Z

Content: {"error":"invalid_client","error_description":"AADSTS70002: The provided request must include a 'client_secret' input parameter. Trace ID: 503dcd2c-650c-4577-b1e7-2ce1a5cb1e01 Correlation ID: 5b1f4951-27ce-4edc-8f9a-81fe695002d8 Timestamp: 2025-02-24 22:39:43Z","error_codes":[70002],"timestamp":"2025-02-24 22:39:43Z","trace_id":"503dcd2c-650c-4577-b1e7-2ce1a5cb1e01","correlation_id":"5b1f4951-27ce-4edc-8f9a-81fe695002d8","error_uri":"https://login.microsoftonline.com/error?code=70002"}

Expected behavior

I expect that after logging in the code will print my display name

How to reproduce

Run the code provided above

SDK Version

1.21.0

Latest version known to work for scenario above?

No response

Known Workarounds

No response

Debug output

Click to expand log

```

</details>


### Configuration

_No response_

### Other information

_No response_

[musale]

Hello @JeffreyEnglish

The error occurs probably because the InteractiveBrowserCredential requires additional configuration for consumer (personal) Microsoft accounts. Therefore;

1. For personal Microsoft accounts, use PublicClientApplicationCredential instead
2. Add proper redirect URI configuration

Here's the corrected code:

import asyncio
from azure.identity import PublicClientCredential
from msgraph import GraphServiceClient

credential = PublicClientCredential(
    client_id="c4368f6a-49b2-4219-8a57-76249566c5fd",
    redirect_uri="http://localhost:8000",  # Make sure this matches your app registration
    tenant_id="consumers"
)

scopes = ["User.Read"]
client = GraphServiceClient(credentials=credential, scopes=scopes)

async def me():
    me = await client.me.get()
    if me:
        print(me.display_name)

asyncio.run(me())

Additionally, make sure to:

1. Configure the redirect URI in your Azure AD app registration
2. Under "Authentication" tab:
   • Add http://localhost:8000 as a redirect URI
   • Select "Public client/native (mobile & desktop)"
   • Enable "Allow public client flows"

The error AADSTS70002 https://learn.microsoft.com/en-us/entra/identity-platform/reference-error-codes indicates that the authentication flow is trying to use a confidential client flow (which requires a client secret) instead of a public client flow that's appropriate for desktop applications.

[musale]

As a side note, the code in the README should also be updated. Thanks for calling that out.

[microsoft-github-policy-service]

This issue has been automatically marked as stale because it has been marked as requiring author feedback but has not had any activity for 4 days. It will be closed if no further activity occurs within 3 days of this comment.