Invalid Audience for Resource (O365/Outlook API)

Byron Hayes 41

So I created/registered an app. But no where in this app registration can I state that it is an outlook application.
Otherwise, I am able to get a token but the token does not work on outlook endpoints. Need help for the error

'Invalid Audience for Resource"{"error":{"code":"InvalidAudienceForResource", "message":"The audience claim value is invalid for current resource. Audience claim is 'api://OUR-APP-ID_SET-AS-SCOPE', request url is 'https://outlook.office.com/api/v2.0/me/messages' and resource type is 'Exchange'.", "innerError": {"requestId": "c7fe963f-a7cb-4c1f-a869-83402fdeee76","date":"2020-02-11T03:55:07}}}

Note, I tried updating the scope in the call and because it isn't like the app-id it won't allow that. tried adding the outlook scope 'mail.read' to the app and said it is owned by Microsoft. Not sure how to move forward an update scope, or if that is the issue at all.

Saurabh Sharma 23,816 Reputation points Microsoft Employee

2020-02-19T20:59:29.537+00:00

What scope you are passing to outlook end point ? Have you tried passing the scope fully qualified with outlook.com e.g. https://outlook.office.com/Mail.Read. I would also suggest you to use the Microsoft Graph for outlook as O365 services are now exposed via Microsoft Graph and it is recommended to use for any new application you are building. Please refer to the Outlook mail API for details.
Byron Hayes 41 Reputation points

2020-02-20T14:29:43.217+00:00

@sashar-msft thank you for your reply. I have tried passing that scope as a part of the client credential oauth call in order to get the access_token and I receive an invalid scope error.

Error when I try to replace the current scope which is api://{MY-APP-ID} with https://outlook.office.com/Mail.Read :

{"error":"invalid_scope","error_description":"AADSTS70011: The provided request must include a 'scope' input parameter. The provided value for the input parameter 'scope' is not valid. The scope https://outlook.office.com/Mail.Read is not valid.\r\nTrace ID: 5fb22442-1647-4f48-9e25-b3bf6df91200\r\nCorrelation ID: 9f84bd15-b58b-4e88-a201-2608218fdee9\r\nTimestamp: 2020-02-20 14:14:18Z","error_codes":[70011],"timestamp":"2020-02-20 14:14:18Z","trace_id":"5fb22442-1647-4f48-9e25-b3bf6df91200","correlation_id":"9f84bd15-b58b-4e88-a201-2608218fdee9"}
Saurabh Sharma 23,816 Reputation points Microsoft Employee

2020-02-20T21:25:36.763+00:00

can you please provide request details over here(after removing sensitive information), so that i can take a look. Also, have you tried achieving the same using Microsoft Graph as per the shared documentation ?
Byron Hayes 41 Reputation points

2020-02-20T22:07:03.397+00:00

The request details:
Post Request for Token
"client_id": "{Client-ID}",
"client_secret": "{Client-Secret}",
"tenant": "f5d73c4c-bb3d-421b-8bee-424916a4abba",
"scope": "https://graph.microsoft.com/.default"

Changed the scope to a graph .default variant and I am still able to retrieve a token which is great. However I am still getting errors after I pass the access_token to a simple Get Request endpoint like /v1.0/me/messages/ (obviously using Microsoft Graph)

error: BadRequest
Saurabh Sharma 23,816 Reputation points Microsoft Employee

2020-02-21T00:00:36.6+00:00

What's the error you are getting? Are you getting the same error with the Microsoft Graph ?
Byron Hayes 41 Reputation points

2020-02-21T17:57:24.517+00:00

@sashar-msft When I run it with graph and set my permissions correctly (not delegate, only application), the call accepts the graph-scoped access_token.
So now I have another question. Why is it that for newly registered applications we should strictly use graph? Is it because permissions for mail related API calls can only be updated through Graph? For instance, for a newly created application I could not find permissions for outlook but I could find permissions for outlook mail in Graph when I wanted to 'Add a Permission'.
Saurabh Sharma 23,816 Reputation points Microsoft Employee

2020-02-24T19:32:40.91+00:00

Have you tried checking for Exchange under the Supported legacy APIs section of Request API Permissions blade.

Once Exchange is selected you will be able to see both "Delegated" and "Application" Permissions.

Also, refer to the Retrieving a message section which talks about the endpoints you should be using against Outlook API.
Saurabh Sharma 23,816 Reputation points Microsoft Employee

2020-02-25T18:07:54.093+00:00

Are you able to check this.

1 answer

Vasil Michev 107.3K Reputation points MVP

2020-02-21T07:03:06.873+00:00

Try using 'https://outlook.office365.com' as the audience value.
Please sign in to rate this answer.
Byron Hayes 41 Reputation points

2020-02-21T18:36:32.547+00:00

@Vasil Michev For this 'audience value' I am getting the following error:

'{"error":{"code":"NoPermissionsInAccessToken","message":"The token contains no permissions, or permissions can not be understood.","innerError":{"requestId":"62c115da-4542-45d3-81fc-de4379ba57ff","date":"2020-02-21T18:35:46"}}}'

Only option to work so far was to use Microsoft Graph
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Invalid Audience for Resource (O365/Outlook API)

1 answer

Your answer