diff --git a/GraphWebApi/Controllers/GraphExplorerAppModeController.cs b/GraphWebApi/Controllers/GraphExplorerAppModeController.cs
index e8668b485..01ea80cae 100644
--- a/GraphWebApi/Controllers/GraphExplorerAppModeController.cs
+++ b/GraphWebApi/Controllers/GraphExplorerAppModeController.cs
@@ -6,12 +6,20 @@
 using System.Collections.Generic;
 using System.Linq;
 using System.Threading.Tasks;
+using Microsoft.Identity.Web;
+using System.Net.Http;
+using System.Net.Http.Headers;
 
 namespace GraphWebApi.Controllers
 {
     [ApiController]
     public class GraphExplorerAppModeController : ControllerBase
     {
+        private readonly ITokenAcquisition tokenAcquisition;
+        public GraphExplorerAppModeController(ITokenAcquisition tokenAcquisition)
+        {
+            this.tokenAcquisition = tokenAcquisition;
+        }
         [Route("api/[controller]/{*all}")]
         [Route("graphproxy/{*all}")]
         [HttpGet]
@@ -20,6 +28,17 @@ public async Task<IActionResult> GetAsync(string all, [FromHeader] string Author
             return await ProcessRequestAsync("GET", all, null, Authorization).ConfigureAwait(false);
         }
 
+        [Route("api/[controller]/{*all}")]
+        [Route("graphproxy/token/{tenantId}")]
+        [HttpGet]
+        [AuthorizeForScopes(Scopes = new[] { "https://graph.microsoft.com/.default" })]
+        public async Task<string> GetTokenAsync(string tenantId)
+        {
+            // Acquire the access token.
+            string scopes = "https://graph.microsoft.com/.default";
+            return await tokenAcquisition.GetAccessTokenForAppAsync(scopes, tenantId, null);
+        }
+
         [Route("api/[controller]/{*all}")]
         [Route("graphproxy/{*all}")]
         [HttpPost]
diff --git a/GraphWebApi/GraphWebApi.csproj b/GraphWebApi/GraphWebApi.csproj
index d2424b25c..99e0191a5 100644
--- a/GraphWebApi/GraphWebApi.csproj
+++ b/GraphWebApi/GraphWebApi.csproj
@@ -45,10 +45,12 @@
     <PackageReference Include="Microsoft.ApplicationInsights.Web" Version="2.17.0" />
     <PackageReference Include="Microsoft.AspNet.WebApi.Client" Version="5.2.7" />
     <PackageReference Include="Microsoft.AspNetCore.ApplicationInsights.HostingStartup" Version="2.2.0" />
-    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="5.0.7" />
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="5.0.8" />
     <PackageReference Include="Microsoft.AspNetCore.Authorization" Version="5.0.7" />
     <PackageReference Include="Microsoft.AspNetCore.Mvc.NewtonsoftJson" Version="5.0.7" />
     <PackageReference Include="Microsoft.Extensions.Configuration" Version="5.0.0" />
+    <PackageReference Include="Microsoft.Identity.Web" Version="1.14.1" />
+    <PackageReference Include="Microsoft.Identity.Web.MicrosoftGraph" Version="1.14.1" />
     <PackageReference Include="Microsoft.VisualStudio.Azure.Containers.Tools.Targets" Version="1.10.8" />
     <PackageReference Include="Microsoft.VisualStudio.Web.CodeGeneration.Design" Version="5.0.2" />
     <PackageReference Include="Serilog" Version="2.10.0" />
diff --git a/GraphWebApi/Startup.cs b/GraphWebApi/Startup.cs
index 106cde847..f14f69a6d 100644
--- a/GraphWebApi/Startup.cs
+++ b/GraphWebApi/Startup.cs
@@ -28,6 +28,8 @@
 using OpenAPIService.Interfaces;
 using OpenAPIService;
 using System.Threading.Tasks;
+using Microsoft.Identity.Web;
+using Microsoft.AspNetCore.Authentication.OpenIdConnect;
 
 namespace GraphWebApi
 {
@@ -46,6 +48,11 @@ public Startup(IConfiguration configuration, IWebHostEnvironment hostingEnvironm
         // This method gets called by the runtime. Use this method to add services to the container.
         public void ConfigureServices(IServiceCollection services)
         {
+            services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
+                .AddMicrosoftIdentityWebApp(Configuration, "AzureAd")
+                .EnableTokenAcquisitionToCallDownstreamApi()
+                .AddInMemoryTokenCaches();
+            services.AddDistributedMemoryCache();
             services.AddAuthentication(option =>
             {
                 option.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
diff --git a/GraphWebApi/appsettings.json b/GraphWebApi/appsettings.json
index e596398ee..dae7c854d 100644
--- a/GraphWebApi/appsettings.json
+++ b/GraphWebApi/appsettings.json
@@ -1,13 +1,11 @@
 {
   "AzureAd": {
     "Instance": "https://login.microsoftonline.com/",
-    "TenantId": "ENTER_TENANT_ID",
+    "TenantId": "TENANT_ID",
+    "ClientId": "CLIENT_ID",
+    "ClientSecret": "CLIENT_SECRET",
     "Audience": "ENTER_APP_ID_URI",
-    "Issuer": "ENTER_ISSUER_URI",
-    "ClientId": "YOUR_APP_ID_HERE",
-    "ClientSecret": "YOUR_APP_PASSWORD_HERE", 
-    "Scopes": "openid email profile offline_access",
-    "GraphResourceId": "https://graph.microsoft.com/"
+    "Issuer":  "ENTER_ISSUER_URI"
   },
   "Logging": {
     "LogLevel": {