Either scp or roles claim need to be present in the token

Question

I want to read and upload documents to Sharepoint using Graph API. I followed this guide https://learn.microsoft.com/en-us/graph/auth-v2-service?context=graph%2Fapi%2F1.0&view=graph-rest-1.0&tabs=http

I have a Single tenant application. I added Sites.ReadWrite.All application permission and got a consent from admin:

Now I'm testing this integration the same way as in the guide:

curl --location --request POST "https://login.microsoftonline.com/${TENANT_ID}/oauth2/v2.0/token" \
--header "Content-Type: application/x-www-form-urlencoded" \
--data-urlencode "client_id=${CLIENT_ID}" \
--data-urlencode "scope=https://graph.microsoft.com/.default" \
--data-urlencode "client_secret=${CLIENT_SECRET}" \
--data-urlencode "grant_type=client_credentials"

Response contains access token, but I can not find "scp" or "roles" scopes after decoding it.

And of course the next request which includes this token returns an error:

curl --request GET "https://graph.microsoft.com/v1.0/sites/root" \
--header "Authorization: Bearer ${ACCESS_TOKEN}" \
--data ""

Response:

{"error":{"code":"AccessDenied","message":"Either scp or roles claim need to be present in the token.","innerError":{"date":"2024-04-04T13:37:12","request-id":"a88a29e8-46e6-4c90-a742-4b8203bd6cbe","client-request-id":"a88a29e8-46e6-4c90-a742-4b8203bd6cbe"}}}

What am I doing wrong? I've read a dozen similar questions but couldn't find an solution yet.

Answer 1

Hi @Oleg Beloglazov

You grant the "Sites.ReadWrite.All" application permission under the SharePoint REST API and not under the Graph API, so the permission is not synced into the Graph API token.

Now you just need to grant this permission under the Graph API:

Hope this helps.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.