Configure Microsoft Graph API for large group memberships

Microsoft Graph API configuration is supported only from AIM 6.1 onwards and required only when the signed in user belongs to a large number of groups (approximately 50 or more).

As the number of group memberships increases, the authentication token becomes larger. This may exceed the HTTP request-header size limit and result in the following error: HTTP Error 400: The size of the request headers is too long.

To address this issue, groups must be excluded from the authentication claims.

With this approach, group membership information is not included in the authentication claims. Instead, AIM retrieves the user's group membership information through the Microsoft Graph API.

This prevents the authentication token from growing due to group memberships and avoids HTTP request-header size limitations.

To use this approach, update the Microsoft Entra ID application configuration as described below:

1. Update the application manifest: In the Microsoft Entra ID application, open Manifest and set groupMembershipClaims to None.

   This setting excludes group membership information from authentication claims.

   

2. Create a client secret: In the Microsoft Entra ID application, create a new client secret and record the generated secret value.

   The secret value is displayed only during creation and is required when you configure the web.config file in a later step.

   

3. Add API Permissions:

   1. In the Microsoft Entra ID application, open API permissions.

   2. Select Add a permission.

   3. Under the Microsoft APIs tab, select Microsoft Graph.

   4. Select Delegated permissions.

   5. Under User, select User.Read.

   6. Select Add permissions.

      

      After you add the permission, its status is blank. An administrator must grant consent before the permission can be used.

      

4. Verify that the permission status displays a green check mark after administrator consent is granted.

   

5. Configure the client secret in web.config: Add the client secret obtained in Step 2 to the <appSettings> section of the application's web.config file.

   <add key="avevanet:graphClientSecret" value="ClientSecret_Value" />