graph api InvalidAuthenticationToken

Question

graph api InvalidAuthenticationToken

neeraj badalu 41

Hi
We are using graph api to create appointment\event in exchange using below code which working fine with "microsoftonline.com" and "graph.microsoft.com" as below. our one client having domin "microsoftonline.us" and "graph.microsoft.us"

    Helper.Setting setting = Helper.ExchangeSetting.GetSetting(exchangeConfigName);  

            IConfidentialClientApplication app = ConfidentialClientApplicationBuilder.Create(setting.ClientIdGrpah)  
              .WithAuthority($"https://login.microsoftonline.com/{setting.TenantIdGraph}")  
              .WithRedirectUri(setting.PublicNotificationUrl)//("http://localhost")  
              .WithClientSecret(Helper.Cryptography.DecryptText(setting.ClientSecretGraph))  
              .Build();  
            string[] scopes = new string[] { "https://graph.microsoft.com/.default" };  

            AuthenticationResult authResult = await app.AcquireTokenForClient(scopes).ExecuteAsync().ConfigureAwait(false);  
           
            return authResult.AccessToken;

To over come this cross domain issue we have change code to WithAuthority($"https://login.microsoftonline.us/{setting.TenantIdGraph}")
string[] scopes = new string[] { "https://graph.microsoft.us/.default" };
After code change we are getting token but when we try to create appointment\event we are getting below issue
Message: Access token validation failure. Invalid audience.
Inner error:
AdditionalData:
date: 2022-03-07T15:23:25
request-id: 53918c5f-6ba7-4869-984b-99e805d67aa1

Same permission has given on graph api (graph.microsoft.us)in azure which works for (graph.microsoft.com).

Need your experts help

CarlZhao-MSFT 46,406 Reputation points

2022-03-10T07:32:20.923+00:00

Use https://jwt.ms/ to parse your access token and share screenshots.
CarlZhao-MSFT 46,406 Reputation points

2022-03-10T07:33:49.103+00:00

This error is due to scope.
CarlZhao-MSFT 46,406 Reputation points

2022-03-10T07:59:25.18+00:00

You're getting a token for the US Government L4 graph endpoint(.us), but your SDK is still calling the graph global service endpoint(.com) when calling the api, so that's causing a 401 error.
neeraj badalu 41 Reputation points

2022-03-10T10:29:01.947+00:00

please find token
neeraj badalu 41 Reputation points

2022-03-10T10:30:31.82+00:00

what i need to do as permission already set for Calendar read\write?
neeraj badalu 41 Reputation points

2022-03-10T10:32:19.477+00:00

what should need to do over come ? call from token shows for "graph.microsoft.us"
CarlZhao-MSFT 46,406 Reputation points

2022-03-11T03:18:14.577+00:00

I haven't used the US Government L4 graph endpoint(.us), but from my experience this should be a problem with the SDK, can you test it with postman?
CarlZhao-MSFT 46,406 Reputation points

2022-03-11T03:21:08.31+00:00

Use your token to call graph.microsoft.us api test in postman, remember to share your test screenshot with me.

1 answer

Your answer

CarlZhao-MSFT 46,406 Reputation points

2022-03-10T07:32:20.923+00:00

Use https://jwt.ms/ to parse your access token and share screenshots.
CarlZhao-MSFT 46,406 Reputation points

2022-03-10T07:33:49.103+00:00

This error is due to scope.
CarlZhao-MSFT 46,406 Reputation points

2022-03-10T07:59:25.18+00:00

You're getting a token for the US Government L4 graph endpoint(.us), but your SDK is still calling the graph global service endpoint(.com) when calling the api, so that's causing a 401 error.
neeraj badalu 41 Reputation points

2022-03-10T10:29:01.947+00:00

please find token
neeraj badalu 41 Reputation points

2022-03-10T10:30:31.82+00:00

what i need to do as permission already set for Calendar read\write?
neeraj badalu 41 Reputation points

2022-03-10T10:32:19.477+00:00

what should need to do over come ? call from token shows for "graph.microsoft.us"
CarlZhao-MSFT 46,406 Reputation points

2022-03-11T03:18:14.577+00:00

I haven't used the US Government L4 graph endpoint(.us), but from my experience this should be a problem with the SDK, can you test it with postman?
CarlZhao-MSFT 46,406 Reputation points

2022-03-11T03:21:08.31+00:00

Use your token to call graph.microsoft.us api test in postman, remember to share your test screenshot with me.

Answer 1

Anonymous

Hi @neeraj badalu , if you're using the US Government L4 endpoint, please review this document and make sure everything is configured properly. As Carl mentioned, you need to make sure the SDK is referencing it and not another endpoint.

Best,
James

Share via

graph api InvalidAuthenticationToken

1 answer

Your answer