Disable Azure AD Graph API with blockAzureADGraphAccess

As mentioned by you and mentioned in the MsDoc, to avoid using Azure AD Graph API you need to do a PATCH request to the application and body as "blockAzureADGraphAccess": true.

Initially, I tried to create user using Azure AD Graph API and the user got created successfully:

public class AzureADService
{
    private string _clientId = "ClientID";
    private string _clientSecret = "Secret";
    private string _tenant = "TenantID";
    private string _graphApiUrl = "https://graph.windows.net/";
    private async Task<string> GetAccessTokenAsync()
    {
        var authContext = new AuthenticationContext($"https://login.windows.net/{_tenant}");
        var credential = new ClientCredential(_clientId, _clientSecret);

        AuthenticationResult result = await authContext.AcquireTokenAsync(_graphApiUrl, credential);
        return result.AccessToken;
    }

    public async Task CreateUserAsync(string json)
    {
        string accessToken = await GetAccessTokenAsync();
        HttpClient httpClient = new HttpClient();
        string url = $"{_graphApiUrl}{_tenant}/users?api-version=1.6";
        HttpRequestMessage request = new HttpRequestMessage(HttpMethod.Post, url);
        request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
        request.Content = new StringContent(json, Encoding.UTF8, "application/json");
        HttpResponseMessage response = await httpClient.SendAsync(request);
        if (response.IsSuccessStatusCode)
        {
            Console.WriteLine("User created successfully.");
        }
        else
        {
            string errorContent = await response.Content.ReadAsStringAsync();
            Console.WriteLine($"Error: {response.StatusCode} - {response.ReasonPhrase}");
            Console.WriteLine($"Error Content: {errorContent}");
        }
    }
      public async Task ExampleCreateUser()
    {
        string json = JsonConvert.SerializeObject(new
        {
            accountEnabled = true,
            displayName = "ruktest33",
            mailNickname = "ruktest33",
            userPrincipalName = "[email protected]",
            passwordProfile = new
            {
                password = "***" 
            }
        });

        await CreateUserAsync(json);
    }
}

public class Program
{
    public static async Task Main(string[] args)
    {
        AzureADService service = new AzureADService();
        await service.ExampleCreateUser();
    }
}

To block the application to use Azure AD Graph API, I executed the below query:

PATCH https://graph.microsoft.com/beta/applications/ObjectID/authenticationBehaviors
Content-Type: application/json

{
    "blockAzureADGraphAccess": true
}

After doing the above wait for few minutes, and then rerun the code:

I got the error as "Authentication_Unauthorized:Access blocked to AAD Graph API for this application" like below:

But it is suggested to use Microsoft Graph API endpoints (e.g., https://graph.microsoft.com/v1.0/users) to access users, groups etc.

• It is important to ensure that your application is updated to use Microsoft Graph API as soon as possible to avoid any disruptions.

Reference:

Microsoft Graph overview - Microsoft Graph | Microsoft