How can i pass access token generated using AD Multi factor authentication to authenticate web api?

Question

Hi,

I am using ad Multi factor authentication to login mobile app. After successful login getting access token. But when I am passing this access token to web api it is giving unauthorized error. How can i pass MFA generated token to web api, Whether it is possible or not?

In android platform i am using following method for MFA,

var authResult = await authContext.AcquireTokenAsync(resource, clientId, uri, platformParams);

Answer 1

Hi @Sharayu Mundhe · Thank you for reaching out.

Having Azure AD MFA enabled or disabled doesn't make any difference in how you pass the Access Token to a Web API. You need to make sure that the token that you get after successful authentication contains required permissions in the scp (scope) claim. I am suspecting that your Web API requires certain scopes to be present in the token, in order to authorize the user(s).

For this purpose, you need to navigate to:

Azure AD > App Registrations > Select your app > API permissions > select your API from Microsoft APIs/APIs my organization uses/My APIs > Add appropriate scope > Grant admin consent.

Once you successfully acquire a token, decode the token at https://jwt.ms to verify if it includes required scope(s).

Additional ref:

• Quickstart: Sign in users and call the Microsoft Graph API from an Android app
• https://learn.microsoft.com/en-us/graph/notifications-integration-app-registration

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.