How can I concatenate https://auth.msft.communication.azure.com/Teams.ManageCalls with other scopes like calendars.read

Question

I'm implementing the Oauth2 device code authentication in a app that runs in a point of sale terminal based on linux, we want to allow the user to sign in, see their calendar and join a Teams meeting in our custom client.

First, requesting:
https://login.microsoftonline.com/organizations/oauth2/v2.0/devicecode

Until now, we are able to get the token passing the below string as scope:
https://auth.msft.communication.azure.com/Teams.ManageCalls

and the apps can perform teams calls.

If we pass as scope:
user.read user.readbasic.all calendars.read contacts.read offline_access openid

I can get the calendar and contacts.

The problem is that if we want to combine the scopes, the Teams.ManageCalls is not included on the response of:
https://login.microsoftonline.com/organizations/oauth2/v2.0/token
(please see images).

This is the intended scope:

user.read user.readbasic.all calendars.read contacts.read offline_access openid https://auth.msft.communication.azure.com/Teams.ManageCalls

I have noticed that if I put:

https://auth.msft.communication.azure.com/Teams.ManageCalls

At the beggining of the scope, it is included in the response scope but nothing more (user.read user.readbasic.all ...)

So, How can I pass

user.read user.readbasic.all calendars.read contacts.read offline_access openid https://auth.msft.communication.azure.com/Teams.ManageCalls

as scope?

Answer 1

Hi @Carlos Corona ,

Thanks for reaching out. I understand you are trying to add scopes for different resources to get the access token, but not able to get all the scopes together in the access token.

As mentioned, you are trying to get the access token for two different resources Microsoft Graph API (user.read user.readbasic.all calendars.read contacts.read offline_access openid) and Azure Communication Services resource(https://auth.msft.communication.azure.com/Teams.ManageCalls) at the same time.
Unfortunately, The Microsoft identity platform does not allow you to get a token for several resources at once and only read scope for a single resource at a time.

You would require different access token to call different resources in Azure.

However, if you are using MSAL.net library, you can use .WithExtraScopeToConsent method in your application which will allow you to silently get the token for another API after calling first webAPI.

Reference: https://learn.microsoft.com/en-us/azure/active-directory/develop/msal-net-user-gets-consent-for-multiple-resources

Hope this will help.

Thanks,
Shweta

---------------------------------

Please remember to "Accept Answer" if answer helped you.