Can I use the bootstraptoken from office.js to silently get an accesstoken for Graph?

Question

I have an Office-js Add-in that works with msal-angular@alpha. Login and logout work fine albeit with only one account. I want to use my user that's logged in to Office and skip the account selection.

Office.js offers an OfficeRuntime.auth.getAccessToken() which gives me a bootstraptoken. But the documentation from Microsoft says I need a backend service that has to exchange the bootstrap for an accesstoken for use with MSgraph with a post to https://login.microsoftonline.com/common/oauth2/v2.0/token. This makes the bootstraptoken feel like some sort of refresh_token but it doesn't seem to be.

Can @azure/msal-angular help here? Can I give the bootstraptoken to msal to get the user a proper acces_token somehow so the add-in can access his sharepoint sites (graph endpoints)?

question from:https://stackoverflow.com/questions/65904757/can-i-use-the-bootstraptoken-from-office-js-to-silently-get-an-accesstoken-for-g

Answer 1

The only way to get access to Microsoft Graph with the bootstrap token is to exchange it for a Graph access token. You have to do the exchange with the "on the behalf of" flow which requires server-to-server interaction, so you can't avoid having a back end.