B2C support use the client ID as the scope but AAD doesn't.

Question

I realize that B2C support use Client ID as scope: https://learn.microsoft.com/en-us/azure/active-directory-b2c/access-tokens#openid-connect-scopes

This is a very interesting feature and sometimes very effective. But in AAD, which doesn't support this feature.
When i try to use Client ID as scope. I will get the error:

The application 'xxx-xxx' asked for scope 'xxx-client-xxx' that doesn't exist on the resource '00000003-0000-0000-c000-000000000000'

It seems that which use AAD Graph as default resource server.

Is there any reason that AAD shouldn't support this feature?

Answer 1

Hi @Zhicheng Liu (CSI Interfusion Inc) • Thank you for reaching out.

Azure AD does support application ID to be used in the scope parameter of the authentication request. However, you have to provide the scope name along with the application ID like 70072b3b-xxxx-xxxx-xxxx-394ae41ec45e/.default or with specific scope like 70072b3b-3966-47d1-8f3f-394ae41ec45e/read. With V2 endpoint, you cannot use only the app ID as scope. Please find below snip for your reference:

If you want to use only the App ID, you may use V1 endpoint which uses resource parameter instead of scope and allows the use of only the app ID. Please refer to below screenshot:

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Hi, @AmanpreetSingh-MSFT , Thanks for your explain.
Sorry i have another question here.
If I use the B2C authorization code process, I can specify the scope I need by specifying &scope. However, in AAD, once a user has authorized a certain scope of an application, subsequent requests will be returned regardless of whether the scope is included in &scope. Is there a way to specify the scope I need to return?

Here is my request for AAD, even the scope i requested is just user.read and openid, which return all the scopes which i have ever authorized.

Here is my request for B2C, which only returned the scope i asked in scope, which is great.