წაკითხვა ინგლისურად

გაზიარება არხიდან:

Deprecate Azure AD graph token

  • სტატია

Applies to: Partner Center | Partner Center operated by 21Vianet | Partner Center for Microsoft Cloud for US Government

To improve our security posture, we're deprecating graph.windows.net audience tokens. To align with this improvement, we're changing how you call Partner Center APIs. Take the necessary actions to prepare for this change.

მნიშვნელოვანი

If you use the generateToken API, stop decoding the token in the API response, and remove dependency on any of the claims in the token that the API returns. The newer version of the API might not contain all the claims.

Here's what you can expect:

  • Starting 27-February-2025:
    • A new version of the generateToken API https://api.partnercenter.microsoft.com/v3/generatetoken is available that only accepts api.partnercenter.microsoft.com audience tokens for both usertoken and app-only scenarios. Partners must make this change before the end of August 2025.
    • If you call the Partner Center API directly by sending an Azure AD Graph audience token, you must start sending api.partnercenter.microsoft.com.
      • Current: resource=https://graph.windows.net&client_id={client-ID-here}&client_secret={client-secret-here}&grant_type=client_credentials
      • New: resource=https://{domain}&client_id={client-ID-here}&client_secret={client-secret-here}&grant_type=client_credentials
        • For example, resource=https://api.partnercenter.microsoft.com&client_id={client-ID-here}&client_secret={client-secret-here}&grant_type=client_credentials
    • For china, https://graph.chinacloudapi.cn must be changed to https://partner.partnercenterapi.microsoftonline.cn
  • Planned for August 2025:
    • Older version of generatetoken API is being deprecated (v3 continues to work)
    • Partner Center APIs are no longer accepting graph.windows.net audience tokens

Related content