This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(12.8, 85%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EG%3C/text%3E%3C/svg%3E)
Hi I'm following this document by Auth0
https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/azure-active-directory/v2
to establish a connection between Auth0 and Microsoft Azure Directory. From our understanding, we should be able to query Microsoft Graph API with our Auth0 Token provided that we configure it correctly. I can see that successful login on both Auth0 and Microsoft Application sign-in logs. But currently, we are getting the following error if I were to call graph API:
"code": "InvalidAuthenticationToken",
"message": "Signing key is invalid.",
"innerError": {
"date": "2024-10-04T04:29:24",
"request-id": "cb0a6894-3b78-4833-b330-1fa691846255",
"client-request-id": "cb0a6894-3b78-4833-b330-1fa691846255"
}
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Hello G9000,
Thank you for reaching out to Microsoft Support!
The error message for your key is invalid, please check your client ID, client secret is expired, is correct, as shown below:
Hope this helps.
If the answer is helpful, please click Accept Answer and kindly upvote it. If you have any further questions about this answer, please click Comment.
I just changed and updated it so it should not be expired. Also, the clientId is correct.
Ok I got it working after extracting MS Token from Auth0 Management API. But now I encounter a new issue.
I can't call Calender at all. I got the following error
{
"error": {
"code": "ErrorAccessDenied",
"message": "Access is denied. Check credentials and try again."
}
}
I already add permission.
But then I realized my scope after decoding my token
"scp": "email openid profile User.Read",
The issue is I use Auth0 with an AD connection. I'm not sure the proper place to pass the scopes
If you use Auth code flow, the permission you need to add should be the delegated permissions, add the delegate permission and get the token again.
Reference document:
https://learn.microsoft.com/en-us/graph/api/calendar-get?view=graph-rest-1.0&tabs=http
I tried that previously but still same issue.
After you add delegation permissions, re-parse the obtained tokens to check whether the scp in the parsed result has changed.
Ok, it works, does it cache for existing users? I tried to log in thru Copilot, but it did not prompt me to allow access just a silent login. It works for new accounts tho.
I'm glad it worked. Yeah, there's a cache, and when you log in, it's going to be cached and automatically logged in.
Please don’t forget to click "Accept Answer" which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.
Is there a way for me to clear the cache for the DC? I accidentally connect to staging oauth and the only way for me currently is sideload a new one which took a long time
You can refer to this document to perform operations.
This is copilot oauth. Notice the Calander is not part of the permission inside the prompt. The return scope also dint include a calendar.
It will only work if I am granted tenant-wide. But since this will not work for other user from other tenant
For context, this is enterprise app and email not personal