Native App ADAL 3 w/ Microsoft Graph resource keep getting same scopes

Question

I have a registered a native app (WPF) with AAD and set it up to have permissions to Microsoft Graph. I had a small set of delegated permissions to start. Everything worked great - ie, reading user's calendar.

I have added some additional permissions (SendMail specifically). When I want to use the Graph SDK to send email, I get an access error. When I check the access token returned by ADAL, it only contains the scopes "scp": "Calendars.Read offline_access Tasks.Read User.Read".

Pretty simple ADAL call...

_authClient = HermesAuthenticationClient.CreateAuthenticationClient(clientId, _redirectUri,  authority);
var result = await _authClient.AcquireTokensAsync(resource, new PlatformParameters(PromptBehavior.Always));

Any pointers would be much appreciated.

Answer 1

There is a known issue involving changing scopes of an existing application. Because you have already authorized that application using the previous scopes, it is unaware of the additional scopes that have been requested. In other words, the old scopes you authorized are cached and the new scopes aren't recognized.

You'll need to manually revoke permissions for the application under "My Apps".

Alternatively you can generate new id's for the app which will also trigger the "request permission" workflow.