Cross-origin token redemption is permitted only for the 'Single-Page Application

Question

Explanation of the error: The error we're encountering, AADSTS9002326: Cross-origin token redemption is permitted only for the 'Single-Page Application' client-type, indicates that your Azure AD registered app is trying to redeem a token from a different origin (in this case, https://tenannamet.sharepoint.com) than what Azure AD allows for its configuration. This restriction is in place to prevent security vulnerabilities associated with cross-origin resource sharing (CORS).

Explanation of the script: This JavaScript function, getAccessToken, is designed to asynchronously request an access token from Microsoft's OAuth 2.0 token endpoint for the Microsoft Graph API. It uses jQuery's AJAX methods for the HTTP request and Deferred object for handling asynchronous operations. Here's a breakdown of its key components

The script we use:
function getAccessToken() { var deferred = $.Deferred(); $.ajax({ type: "POST", crossDomain: true, url: https://outlookadd-in.herokuapp.com/https://login.microsoftonline.com/tenantName.onmicrosoft.com/oauth2/v2.0/token, headers: { "content-type": "application/x-www-form-urlencoded" }, data: { grant_type: "client_credentials", client_id: "client id value here", client_secret: "client secret value here", scope: https://graph.microsoft.com/.default }, success: function (data) { deferred.resolve(); token = data.access_token; debugger; }, error: function (data, errorThrown, status) { debugger; console.log(data); } }); return deferred.promise(); } Note: using postman, we get successfully the access token, when using in SharePoint we get the error message:

Answer 1

Do not use it since Microsoft does not have answer for its own logic and MSDN is always deprecated, incorrect, missing information and too complex. It will take decades to understand thousands of different terms, logic, fields, configurations just to goal a simple thing authenticate a user using Identity: MSAL, AzureAD, Graph, IDownstreamApi, Oauth2, OpenConnect, Scope, App Registration, Enterprise Registration...and when you find something you will see everyone using thousands of different approaches either.