OAuth JWT issuer (sts.windows.net) is different from the one exptected and listed in the endpoints (login.microsoft.com)

Question

Hi all

We are trying to implement a new API which use OpenID Connect and OAuth2.0 to grant the API calls.

Wa can successfully make the /authorize and /token calls on Microsoft bur the JWT we get in return has an issuer (sts.windows.net) which is different from the one expected (login.microsoft.com) as described here : https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow

Any idea ?

Answer 1

Yes we have solved it.

May be it's clear for all others users and admin, but to solve it :

• add an API scope in the section "Expose API" of your application
• add the API scope to the scope of your call for token
• ... and try another call it should work (at least for us)

Answer 2

Hi @Jean-François RIVES (Admin)

First you need to find the accessTokenAcceptedVersion property in the list of registered applications, and then change its value to 2.

However, this modification will be delayed, please wait patiently.

Then make sure that the endpoint from which you get your credentials and token requests is v2.

Make sure the request has v2.0 after auth2.

Can refer to this link:

https://stackoverflow.com/questions/59790209/access-token-issuer-from-azure-ad-is-sts-windows-net-instead-of-login-microsofto

Hope this helps.

If the reply is helpful, please click Accept Answer and kindly upvote it. If you have additional questions about this answer, please click Comment.