CODEWITHSUNDEEP
office365microsoft-graph-apimicrosoft-graph-sdks
Oleg Sh
Oleg Sh

Reputation: 9013

Microsoft Graph scope "Domain.ReadWrite.All"

Why I can't set scope Domain.ReadWrite.All for url like:

https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=MY_APP_ID&response_type=code&state=12345&response_mode=query&redirect_uri=https%3A%2F%2Flocalhost%3A44331%2F&scope=domain.readwrite.all

does not work.

https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=MY_APP_ID&response_type=code&state=12345&response_mode=query&redirect_uri=https%3A%2F%2Flocalhost%3A44331%2F&scope=user.read

works. It works also for directory.readwrite.all and any other, but does not work for domain.readwrite.all. Why so?

Upvotes: 0

Views: 556

Answers (1)

Chris Johnson
Chris Johnson

Reputation: 1340

Domain.ReadWrite.All is an application scope (client credential flow, aka app-only) and you are trying to have a user consent to that scope in a delegated auth flow.

To use Domain.ReadWrite.All you would need to do admin consent using the admin consent endpoint like this:

GET https://login.microsoftonline.com/{tenant}/adminconsent ?client_id=6731de76-14a6-49ae-97bc-6eba6914391e &state=12345 &redirect_uri=https://localhost/myapp/permissions

Edited: updated to domain.readwrite.all

Upvotes: 1

Related Questions