Just two days ago I published Set your Teams Status to In a Call when using other Calling & Meeting Apps on iOS. In this article, I explained how we can leverage Siri Shortcuts on iOS to call an Azure Function which then executes web requests against the Microsoft Graph API.

Today I wanted to see if I’m able to get it working without the use of an Azure Function as a middleman. Spoiler alert: I totally was.

You can import the Siri Shortcut from here.

Of course, you need to have an Azure App Registration with the desired permissions ready to use this. Once you’ve imported the shortcut, just fill in the required information in the text fileds. We need the App Id, the App secret and the name (domain) or Id of the tenant.

Let’s take a detailed look of what’s going on inside the Shortcut.

First, an http POST request is made to request the access token. Client_id and client_secret are passed to the request body as variables from the Text fields you populated at the top of the Shortcut.

The Microsoft authentication endpoint returns a JSON string which is similar to what you get when you use Invoke-WebRequest instead of Invoke-RestMethod in PowerShell.

{“token_type”:“Bearer”,“expires_in”:3599,“ext_expires_in”:3599,“access_token”:“eyJ0eXAixboxOiJKV1QiLCJub25jZSI6ITUROWEtpblE4THcwNVN1Z1JMOU1aUUpwdXlqedasd1VpQXNjU3ciLseriesCJhbGciOiJSUzI1NiIsIng1dCI6IjJaUXBKM1VwYmpBWVhZR2FYRUpsOGxWMFRPSSIsImtpZCI6IXjJaUXBKM1VBWVhZR2FYRUp”}

This means that we’ll have to get the value of both the keys “token_type” and “access_token”.

The access token is now stored in the variables token_type (Bearer ) and access_token (Actual token) and available to use in this Shortcut and subsequent web requests. To see if it’s working, we’re just going to make a GET request and return some Azure AD Users.

Here you can see that we use both variables to include the access token in the Authorization Header.

Because this is an OData query, the values will be stored in the value key. So we need to get the value of the value key one more time to see some results.

Of course, this is just an example to prove that the authentication is working without an Azure Function or any PowerShell code. Everything is running on an iOS device. Receiving data from Graph on an iPhone is probably not what people want to use this for, but it was the easiest example.

Using Shortcuts to make http Post requests is much more interesting. Think about all the possibilities here for a second. We could basically do any Post request we want. And then, we can add Shortcuts to the iPhone Homescreen, ask Siri to run Shortcuts or even launch them from an Apple Watch. Amazing.