I can't make application authentication with microsoft identity - Either scp or roles claim need to be present in the token.

Question

I follow this tutorial - https://learn.microsoft.com/en-us/graph/auth-v2-service?context=graph%2Fapi%2F1.0&view=graph-rest-1.0&tabs=http
If I sent request to https://login.microsoftonline.com/{tenant}/adminconsent with "common" as tenant I get error:

AADSTS90027: We are unable to issue tokens from this API version on the MSA tenant. Please contact the application vendor as they need to use version 2.0 of the protocol to support this.

If I sent request to
https://login.microsoftonline.com/{my-tenant-id}/v2.0/adminconsent
or

If I sent request to
https://login.microsoftonline.com/organizations/v2.0/adminconsent

When I click accept and then sent request to oauth2/v2.0/token (with grant_type=client_credentials) I get an access token.

Later when I want to do actions with the tokens I get errors like:

/drives or /sites

Either scp or roles claim need to be present in the token

/users

Insufficient privileges to complete the operation

My application permissions:

Answer 1

Hi @BackNot

Glad to know your issue has been resolved, I'll summarize the issue below to help members with similar issues:

1. If your application is registered as a single-tenant application, you can only log in to users of your own tenant using the /{tenant id} endpoint or /organizations endpoint, and cannot log in to users of other tenants or MSA users using the /common endpoint.
2. Application permissions are organization-based. When granting application permissions, static consent must be performed, i.e. the admin consent URL should be: https://login.microsoftonline.com/{organization}/adminconsent?client_id={client-id}.
3. Only global administrators can grant administrator consent, ordinary administrators or users cannot grant administrator consent.

Hope this helps.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.

Answer 2

I solved it. It turns out I wasn't as big admin as I thought. I made the creator of the accounts login to:

https://login.microsoftonline.com/my-tenant-id/adminconsent

and then my calls to
my-tenant-id/oauth2/v2.0/token returned a token with several roles.