OAuth2 access token received from login.microsoftonline.com not working for on behalf of flow for azure devops api

antonio.mittielu 1

Hi,

I registered an application in Azure Active Directory, granted permission to access Azure DevOps.

As I understand it is possible to use the access token that I got from login.microsoftonline.com to request another access token for Azure DevOps (https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-on-behalf-of-flow) but when I'm trying to do this I get this error: "AADSTS50027: JWT token is invalid or malformed". I can't understand why is this happening. I can use this token for other apis such as https://graph.microsoft.com/v1.0/users and it's working fine.

Am I missing someting? Maybe in application configuration?

Saurabh Sharma 23,676 Reputation points Microsoft Employee

2020-08-14T22:45:34.137+00:00

@antonio.mittielu I believe you need to register your web app to get an app ID from Azure DevOps Services and send your users to Azure DevOps Services for authorization. Once users are authorized and gets an access token then you can call Azure DevOps Services APIs on behalf of that user. Please refer to the link for more. You can also refer to the Choosing the right authentication mechanism which outlines the recommended authentication mechanism.
James Hamil 21,621 Reputation points Microsoft Employee

2020-08-31T18:29:42.06+00:00

Hi, are there any updates with this case? If not, please select the appropriate response as "Answered." Otherwise please let us know how we can assist you.