Why does the SharePoint Online Role not appear in my Azure AD SP Token?

Question

Hi,

i want to use an Azure AD SP to access my SharePoint Sites and Lists.

I added the Sites.FullControl.All role but when i receive my token, i dont see any roles at all.

When i add Application Roles for Microsoft Graph, those roles are displayed in the token.

How do i access my SP with SharePoint Roles, so that i can use Microsoft Graph ?

Best regards,

Mark

Answer 1

Those are different resources (note the value of the "aud" claim in the token you've obtained). If you want to obtain a token that includes the permissions you've granted for the SPO resource, make sure to add the corresponding scope in your token request.

Do note that the Sites.FullControl.All scope is also available for the standard Microsoft Graph resource, so you might as well add it therein (depending on your use case that is).