Page Comparison

Navigate the Azure Active Directory blade (you can search for it in the search bar on the top).

On the left-side menu, navigate to the Roles and administrators page.

In the list, search for either the Global Reader or Security Reader role (both are valid) and click on it to select it.

Click the + Add assignments button.

On the right-side modal, use the search bar to find the application you created. Search by either its name (make sure you write the whole name, not only parts of it) or its Client ID in case you cannot find it. Once it appears on the list, select it.

Click the Add button.

To verify that the role has been correctly assigned, execute the following cURL command replacing (or assigning) the $REPORTING_TOKEN shell variable with the token you obtained in the previous instructions:

$ curl -i -H "Authorization: Bearer $REPORTING_TOKEN" https://reports.office365.com/ecp/ReportingWebService/Reporting.svc

This response will include the HTTP Response code and headers (note the -i parameter). You should expect to get an HTTP 200 OK response with an XML containing at least the <atom:title>MessageTrace</atom:title> tag. Other responses will be incorrect; here are some examples and their explanation:

1. 401 - Unauthorized: Access is denied due to invalid credentials.: your token is either invalid or outdated. Review the previous instructions to obtain a working token.

2. No permission to access the report for the organization.: The role has not been properly assigned. Review these instructions to do it.