3

I am trying to get a Bearer token for my registered Azure AD-App to read all my sharepoint sites via API

I followed the guides from microsoft to a) grant permissions for the app and b get myself a token

so I now a) have all required permissions: enter image description here and b) received a token when using the scope https://graph.microsoft.com/.default

So here is my issue: when I try to get a token for lets say https://microsoft.sharepoint-df.com/Sites.Read.All:

https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token

Body:x-www-form-urlencoded
client_id={appId}
scope=https://microsoft.sharepoint-df.com/Sites.Read.All
client_secret={secret},
grant_type=client_credentials

all I get in return is an error:

"error": "invalid_scope",
"error_description": "AADSTS70011: The provided request must include a 'scope' input parameter. The provided value for the input parameter 'scope' is not valid. The scope https://microsoft.sharepoint-df.com/Sites.ReadWrite.All is not valid.\r\nTrace ID: ...\r\nCorrelation ID: ...\r\nTimestamp: 2019-06-09 07:35:21Z",
"error_codes": [
    70011
],

Am I doing something wrong? I also tried the scope https://{{tenantName}}.sharepoint.com/Sites.Read.All

sk2andy
  • 749
  • 1
  • 8
  • 19
  • Share your full token request sample. – Md Farid Uddin Kiron Jun 10 '19 at 01:05
  • @MdFaridUddinKiron I did so – sk2andy Jun 10 '19 at 12:43
  • 1
    As you permitted your grant for share point on your app so you needn't to set as scope for `scope=https://microsoft.sharepoint-df.com/Sites.Read.All` you can set your `scope=https://graph.microsoft.com/.default` your token would contains the permission for `Sites.Read.All`. If you [Decode](https://jwt.io/) your token [here](https://jwt.io/) you would Seen. If you still have any problem just let me know. – Md Farid Uddin Kiron Jun 10 '19 at 13:28

1 Answers1

5

You are using client credentials flow to get the access token. The scope must be

https://graph.microsoft.com/.default

The value passed for the scope parameter in this request should be the resource identifier (application ID URI) of the resource you want, affixed with the .default suffix. For the Microsoft Graph example, the value is https://graph.microsoft.com/.default. This value tells the Microsoft identity platform endpoint that of all the direct application permissions you have configured for your app, the endpoint should issue a token for the ones associated with the resource you want to use.

If you must use the specific scope like https://microsoft.sharepoint-df.com/Sites.Read.All You can use auth code grant flow to get the access token.

Tony Ju
  • 14,891
  • 3
  • 17
  • 31