Microsoft Graph API error: Access token validation failure. Invalid audience.

Question

We have registered the app in AAD and granted the following permission to Microsoft Graph under API permissions in Azure portal

After passed in tenant id, client id, client secret.

we generated an access token

When I call the users API endpoint, I got an Invalid audience error as below:

Can anyone please point me where the issue is. thank you. I am not sure about resource: "00000002-0000-0000-c000-000000000000"

Answer 1

It works after adding V2.0 in /oauth2/v2.0/token

Answer 2

You should get access token from version 2 of token endpoint as below example

curl --location 'https://login.microsoftonline.com/xxxxxxx-xxxxx-xxxxx-xxxxx/oauth2/v2.0/token' \

--header 'Content-Type: application/x-www-form-urlencoded' \

--data-urlencode 'client_id={Client-ID-HERE}' \

--data-urlencode 'client_secret={CLIENT-SECRET_HERE}' \

--data-urlencode 'grant_type=client_credentials' \

--data-urlencode 'scope=https://graph.microsoft.com/.default'

Answer 3

First of all, you are using the client credentials flow - this requires Application permissions, not Delegate ones. To understand the difference between the two types and decide which one is more appropriate for your scenario, read here: https://learn.microsoft.com/en-us/graph/auth/auth-concepts#delegated-and-application-permissions
Moreover, the method you seem to be using corresponds to the old Azure AD Graph API, not the Microsoft Graph one (audience/resource should be "00000003-0000-0000-c000-000000000000").