How to check if the app is using Oauth or Open ID Connect

Newman 0

Hello,

I was wondering if there is a way to check in azure ad logs if an application is using Oauth or Open ID Connect in the SSO.

Thank you in advance

1 answer

Sandeep G-MSFT 14,326 Reputation points Microsoft Employee

2023-05-17T12:42:04.9466667+00:00

@Newman

Applications configure in Azure AD uses either OpenID connect or SAML protocols.

Oauth is an authorization protocol and OpenID connect is an authentication protocol.

OpenID connect uses Oauth post authentication.

Basically, OpenID connect is an upper layer of authentication and Oauth is an authorization protocol.

Let me know if you have any further questions on this.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Please sign in to rate this answer.

1 person found this answer helpful.
Newman 0 Reputation points

2023-05-18T01:09:31.8566667+00:00

@Sandeep G-MSFT
Thank you for your reply.

SAML protocol is not an issue here but OIDC is.
In my understanding from MS Document is that there are cases where Azure AD is only used to login (through an ID token) to an external app without allowing access to user's protected data ( other than basic info). I am assuming that the only protocol used here is OIDC. Other than that will be Oauth with a protocol that provides an access token allowing the app to run API to user's protected data (Calendar for example).
If my understanding is correct, I'd like to be able to make a difference between the two on admin centers or PowerShell without having to check the app source code.
Thank you in advance.

Sandeep G-MSFT 14,326 Reputation points Microsoft Employee

2023-05-19T06:29:15.3733333+00:00

Newman •

Your understanding is correct in terms of ID token and access token.

If you are looking to make a difference between two admin centers then you will have to get the access token based on scopes and app roles. You can refer below article for this,

https://learn.microsoft.com/en-us/azure/active-directory/develop/scenario-protected-web-api-verification-scope-app-roles?tabs=aspnetcore

Let me know if you have any further questions.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Sign in to comment