CODEWITHSUNDEEP
azureoauth-2.0azure-active-directorymicrosoft-graph-apiazure-ad-graph-api
keystone
keystone

Reputation: 57

Azure mulit-tenant application not getting tokens with newly defined scopes

I am developing a Azure multi-tenant application that uses scopes from the Microsoft Graph API and the Windows Azure Active Directory resources. We are using the v1 OpenID auth code flow.

Recently we added a few more requested scopes to the Microsoft Graph API, we prompted users to reauth using prompt=admin_consent and resource=https://graph.microsoft.com on our /common/oauth2/token exchange.

When the user is prompted to accept scopes again you can see the newly requested scopes and the call seems to complete successfully, we receive a new access_token.

However the scopes that come back in the response AND the embedded JWT claim for scopes only lists a small subset of the requested scopes and they also only seem to be from one of the resources (Windows Azure Active Directory).

We are receiving 403s for the new scopes so I do not think it is a issue of not correctly populating those scope fields.

Does anyone know why the auth flow would not return a token with the newly requested scopes?

Here is a listed of my requested scopes:

Windows Azure Active Directory

Microsoft Graph

Scopes Accept Page

Thanks!

Upvotes: 1

Views: 346

Answers (1)

Navya Canumalla
Navya Canumalla

Reputation: 507

When you make a token request against AAD v1 by specifying a specific resource, the access token returned will contain only the scopes required to access that specific resource. The details and example of the protocol is documented here.

Therefore, if you need to access two resources you will need to request access token for each of them and the corresponding tokens will contain the scopes specific to that resource.

In this case, if the AAD Graph scopes are available in MS Graph, you can consolidate them under the MS Graph and request a single token for MS Graph. During the auth flow, you can control which of these scopes you want to request consent for by specifying them in the scope field of the auth request as mentioned in the description of the parameter here.

Upvotes: 1

Related Questions