Calling Downstream APIs on Behalf of Your Users with Entra ID and the OBO Flow

You've built an API. Your users sign in through Entra ID, and your API receives a nice, valid access token with every request. Life is good. Then someone asks: "Can our API pull the user's department