Using Edu Graph API to read and write classes from an ASP.Net MVC application

Question

Hello guys!

I have granted and consented to all necessary education permissions for my application on Azure AD, Azure portal.

The issue i get when i load my demo application, says it cannot see the permission in my scope, AADSTS650053: The application 'graphapitest' asked for scope 'EduRoster.ReadWrite.All' that doesn't exist on the resource

using delegate authentication for my application,
Any ideas on what i can try next would be very helpful
P.S- i removed the secret to screenshot
@Diana Wanjuhi

Answer 1

EduRoster.Read in delegated mode return the following error to me:

{"statusCode":403,"code":"AccessDenied","requestId":"97ce439a-3ddb-4d77-9014-ce83b37843b4","date":"2022-01-13T06:47:11.000Z","body":"{\"code\":\"AccessDenied\",\"message\":\"Required scp claim values are not provided.\",\"innerError\":{\"date\":\"2022-01-13T03:47:11\",\"request-id\":\"97ce439a-3ddb-4d77-9014-ce83b37843b4\",\"client-request-id\":\"5b2a5a7d-4603-b95c-964d-25e70440f146\"}}"}

Required scp claim values are not provided.

In the SPN i consent all permissions (EduRoster.ReadWrite.All, EduRoster.ReadWrite and various others).

In JWT return this in scp:

"scp": "Calendars.Read Calendars.ReadWrite Directory.Read.All EduRoster.Read EduRoster.ReadBasic EduRoster.ReadWrite MailboxSettings.Read openid People.Read profile User.Read User.ReadBasic.All email",

I'm using @azure/msal-browser and @azure/msal-react in a react project.

Answer 2

EduRoster.Read.All is an application permission. For delegated, please use EduRoster.Read.