CODEWITHSUNDEEP
azureoauthazure-active-directorymicrosoft-graph-api
Richard Turnbull
Richard Turnbull

Reputation: 23

Microsoft Graph OAuth issues

I have a background JS app that wont have any user input, so i was looking at using the app authentication without user input. I have set up an app in the Azure AD portal and also apps.dev.microsoft.com.

I am using the following endpoint:

login.microsoftonline.com/{Tenant}/oauth2/token

With the following body: 

client_id: application_id  
client_secret: generated key  
grant_type: client_credentials   
scope: "https://graph.microsoft.com/.default"

This generates an access_token however when i try and use it using the graph API, I get the following error

Access token validation failure

When investigating the token compared to a normal OAuth token with user input, i noticed its passing in roles rather then scp and the audience is my application rather then graph.microsoft.com.

What am i doing wrong?

Upvotes: 2

Views: 352

Answers (1)

Nan Yu
Nan Yu

Reputation: 27528

The app registered in Azure AD portal works with Azure AD V1.0 endpoint ,app registered in apps.dev.microsoft.com that works with the v2.0 endpoint , Please firstly refer to this document for what's different about the v2.0 endpoint .

To use Azure AD v2.0 to access secure resources without user interaction(client credential flow) , you should send a POST request to the /token v2.0 endpoint:

POST /common/oauth2/v2.0/token HTTP/1.1
Host: login.microsoftonline.com
Content-Type: application/x-www-form-urlencoded

client_id=535fb089-9ff3-47b6-9bfb-4f1264799865&scope=https%3A%2F%2Fgraph.microsoft.com%2F.default&client_secret=qWgdYAmab0YSkuL1qKv5bPX&grant_type=client_credentials

You could refer to this document for how to use the OAuth 2.0 client credentials grant with Azure AD V2.0 endpoint .

If you want to use azure ad v1.0 (app registered in azure portal) with client credential flow, you could refer to this document . In azure ad v1.0 , you should indicate the resource parameter which the client app is requesting authorization for , in your scenario , the resource should be https://graph.microsoft.com/ if you want to acquire token to call microsoft graph api .

Upvotes: 3

Related Questions