VssUnauthorisedException using Azure Devops REST API with VssAadCredentials generated with Access Token from MSAL

Question

I am migrating an application to .Net Core from .Net Framework and replacing the VSS Windows authentication it used to access Azure Devops REST API's with MSAL since the VSS Windows authentication no longer works in .Net core.

After some faffing in MS Azure, I am now being returned an Access Token after an interactive login prompt, however when I use when generating a VssConnection:

new VssConnection("https://dev.azure.com/[ORGANISATION]", new VssAadCredential(new VssAadToken(authResult.TokenType, authResult.AccessToken))));

And then try to use the connection:

connection.GetClient<GitHttpClient>();

I get a VssUnauthorisedException with no further detail.

I have no idea what I need to do to get access to this, I can't see any useful service connection types to add to Azure Devops. It still works in .Net Framework but we would prefer to be able to upgrade to .Net Core

Answer 1

Turns out the scope for azure devops user impersonation that azure portal gave us was wrong, reverting to the one from this example https://github.com/microsoft/azure-devops-auth-samples/blob/master/ManagedClientConsoleAppSample/Program.cs started working.