Why app id uri not working in scope instead app id working

Question

Why app id uri not working in scope instead app id working

Ansamma Thomas 0

I am trying to call a Web api from another using delegated permission, both registered in azure ad. The api I am trying to call is a very old api, using v1 end point. My api uses v2 end point. When I use appId/.default as scope I am successfully authorise and call the old api from my api. When I use appIdUrl/.default I am getting invalid scope. Why appIdUrl/.default as scope failing?

Shweta Mathur 30,296 Reputation points Microsoft Employee Moderator

2023-06-28T08:21:14.02+00:00

Hi @Ansamma Thomas ,

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept Answer" which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

1 answer

Your answer

Shweta Mathur 30,296 Reputation points Microsoft Employee Moderator

2023-06-28T08:21:14.02+00:00

Hi @Ansamma Thomas ,

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept Answer" which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Answer 1

Shweta Mathur 30,296 Microsoft Employee Moderator

Hi @Ansamma Thomas ,

Thanks for reaching out.

I understand you are trying to call webAPI 1 (using v2 endpoint) to call webAPI 2(using v1 endpoint) and getting error while passing appIdUrl/.default in scope.

This is expected as when you use the appId/.default scope, MSAL uses the v1 endpoint to acquire a token for the resource. However, when you use the appIdUrl/.default scope, MSAL uses the v2 endpoint to acquire a token for the resource.

Here you want to acquire a token for all the static scopes of a v1.0 application which requires appIdURL of the API when calling the v1 endpoint.

The reason you are getting an invalid scope error when using appIdUrl/.default is that the v1 endpoint does not recognize the appIdUrl format.

So, to summarize, if you are calling a v1 endpoint, you should use the appId/.default scope, and if you are calling a v2 endpoint, you should use the appIdUrl/.default scope.

https://learn.microsoft.com/en-us/azure/active-directory/develop/msal-v1-app-scopes

Hope this will help.

Thanks,

Shweta

Please remember to "Accept Answer" if answer helped you.

Ansamma Thomas 0 Reputation points

2023-07-01T18:07:53.4566667+00:00

Hi Shweta Mathur,

Thanks for attending my query.

I resolved my issue using appId instead of appIdUrl in scope. But I am still not convinced about your explanation. I doubt any other parameters other than "accessTokenAcceptedVersion" which determines what is to be used in scope?

You mentioned "if you are calling a v1 endpoint, you should use the appId/.default scope, and if you are calling a v2 endpoint, you should use the appIdUrl/.default scope".

But I am able to get onBehalfOf access token for another v1 end point using appIdUrl/.default scope.

Also the azure documentation link you have provided, asks to use appIdUrl for V1 end point, not asking to use appId intead.

https://learn.microsoft.com/en-us/azure/active-directory/develop/msal-v1-app-scopes

See the audience in below screen shot. In this case I am able to get token successfully using appIdUrl in scope for v1 end point.

Manifest for the application is

Share via

Why app id uri not working in scope instead app id working

1 answer

Your answer