To send multiple scope parameters in Azure AD B2C using Client Credentials flow

Question

I'm trying to get multiple scope in access token. I can get all the scopes (app role permissions) which I assigned to the client app by using (/.default) scope. But I don't won't all. I need only the scope which mention in the token request.

Ex: Client App : my_web_app, API app name: my_web_api.

I've assigned the four app roles. And given app permission to my_web_app.

If I use (/.default), I'm getting all four. I try to give two scope but I'm not getting.

Answer 1

Hi @Silambarasan VaradharajThank you for posting this in Microsoft Q&A.

In Client Credentials flow, you must use the special ".default" suffix for the scope. For example, if you wanted a token for an API with client ID {ClientID}, you could use "{ClientID}/.default" as the scope.

The .default scope is a placeholder that represents the entire set of permissions that the API exposes. When the client application requests an access token, the token contains the list of scopes that are exposed by the API and that have been consented to by the app administrator.

If you assign four app roles to an application, the application API will return all four roles, as this is the expected behavior. It is not possible to retrieve only two out of the four roles when using the client credential flow.

For your reference: Set up OAuth 2.0 client credentials flow in Azure Active Directory B2C

Hope this helps. Do let us know if you any further queries.

Thanks,

Navya

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.