Web Api App registration has a configured scope in "Expose an API" section should I add the web api scope in "API permissions" also? what Microsoft Graph permissions should I add?

you should only add the permissions you want the api access token to have. a user can easily get the token and make their own api calls with it. graph user.read is pretty safe, as the user can only get their own profile.

In a web api app registration, should I add the web api "app service" scope in "API permissions"?

Ernesto 61

Web Api App registration has a configured scope in "Expose an API" section

User's image

should I add the web api scope in "API permissions" also? what Microsoft Graph permissions should I add?

User's image

1 answer

Bruce (SqlWork.com) 68,236 Reputation points

2024-05-14T17:56:44.58+00:00

you should only add the permissions you want the api access token to have. a user can easily get the token and make their own api calls with it. graph user.read is pretty safe, as the user can only get their own profile.
Please sign in to rate this answer.
Ernesto 61 Reputation points

2024-05-14T18:36:18.3166667+00:00

but do I need to add web api scope in "API permissions" besides of adding the same scope in in "Expose an API" section or not? or it doesn't matter

Ernesto 61 Reputation points

2024-05-14T18:37:08.6433333+00:00

I have a invalid audience error when I try to call web api from Postman
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

In a web api app registration, should I add the web api "app service" scope in "API permissions"?

1 answer

Your answer