Reverting "accessTokenAcceptedVersion" in manifest to "null" does not work as expected

Question

Reverting "accessTokenAcceptedVersion" in manifest to "null" does not work as expected

Edwin van de Burgt 21

I noticed Logic Apps where calling our Function Apps with OAuth(1) instead of OAuth V2.

So I tried to make the Function Apps work with OAuth2 by updating its AD Appregistration Manifest "accessTokenAcceptedVersion" from null to 2 and that seems to work.

However, I needed to rollback this change, because otherwise all Function Apps needed to be updated (Issuer URL) and that is currently not an option.

But after reverting back from 2 to null, all Function Apps fail their OAuth authorization with a 401 (the Function App has of course been restarted).

So it appears that apart from the accessTokenAcceptedVersion change, something else changed, maybe under water and we can't get back to the original situation.

We're at a total loss now how to go back to the original situation and hope somebody can shed a light on this problem...

Marilee Turscak-MSFT 37,206 Reputation points Microsoft Employee Moderator

2020-08-17T20:57:40.467+00:00

The only option to force AzureAD to issue a V2 access token to some custom WebApi is to explicitly set in its manifest accessTokenAcceptedVersion to 2. The Web API decides the accepted token version, independently of the protocol version. https://learn.microsoft.com/en-us/azure/active-directory/develop/access-tokens#claims-in-access-tokens

There is a working example in this thread that may be helpful to you. https://stackoverflow.com/questions/61084891/how-to-get-a-v2-jwt-token-when-authorizing-against-azuread-in-postman

Your answer

Marilee Turscak-MSFT 37,206 Reputation points Microsoft Employee Moderator

2020-08-17T20:57:40.467+00:00

The only option to force AzureAD to issue a V2 access token to some custom WebApi is to explicitly set in its manifest accessTokenAcceptedVersion to 2. The Web API decides the accepted token version, independently of the protocol version. https://learn.microsoft.com/en-us/azure/active-directory/develop/access-tokens#claims-in-access-tokens

There is a working example in this thread that may be helpful to you. https://stackoverflow.com/questions/61084891/how-to-get-a-v2-jwt-token-when-authorizing-against-azuread-in-postman

Share via

Reverting "accessTokenAcceptedVersion" in manifest to "null" does not work as expected

Your answer