Token Generation Issue for Newly Registered App in Microsoft Corp Tenant

Question

Encountering an error when attempting to generate a token for a newly registered app using a client ID and secret. The app is registered within the Microsoft Corp tenant. While able to generate tokens for existing apps, facing difficulties in generating tokens for recently created apps. The goal is to invoke an API from Power Apps, where an app has been registered, and delegated access to the API app has been granted. However, during the token generation process using client ID, secret, and scope in OAuth2.0, receiving the following error message.

"AADSTS53003: Access has been blocked by Conditional Access policies. The access policy does not allow token issuance.

Answer 1

The error message suggests that the requests are being blocked by Conditional access policies, i.e. your tenant is deliberately restricting access. This is something you should address with your internal IT support team.

Answer 2

Hello @Amarnath Baranasi

The error message you’re encountering, “AADSTS53003: Access has been blocked by Conditional Access policies. The access policy does not allow token issuance,” indicates that there are Conditional Access policies in place that prevent the issuance of tokens for your newly registered app. Let’s troubleshoot this issue:

1. Check Conditional Access Policies:

• Navigate to Azure Active Directory (AAD) and go to Security > Conditional Access.
• Examine the current Conditional Access policies to identify any that might be blocking token issuance for your app.
  • You may need to adjust or create a new policy that allows your app’s service principal to issue tokens

1. Contact Your Admin:

• Reach out to the admin in your Microsoft 365 tenant to confirm the specific criteria that your app must meet to avoid being blocked by Conditional Access policies.
  • They can provide guidance on adjusting the policies to allow token issuance for your app

Remember that Conditional Access policies are designed to enhance security, but sometimes they can inadvertently block legitimate requests. By working with your admin, you can ensure that your app can successfully generate tokens and invoke the desired API from Power Apps.