"The scope https://graph.microsoft.com/Calendars.Read is not valid" error while getting access token for my app

Question

I am trying to use MS graph API to access user's calendar events but while trying to get the access token for my app that I registered in azure,

I am getting the following error:

Error : The scope https://graph.microsoft.com/Calendars.Read is not valid.

Below is my code:

string token = string.Empty;
            IConfidentialClientApplication app;
            app = ConfidentialClientApplicationBuilder.Create("ClientID")
                .WithTenantId("TenantID")
                .WithClientSecret("ClientSecret")
                .Build();

            string[] scopes = new string[] { "https://graph.microsoft.com/Calendars.Read" };

            AuthenticationResult result = null;

            try
            {
                result = await app.AcquireTokenForClient(scopes).ExecuteAsync();
                token = result.AccessToken;

                var graphServiceClient = new GraphServiceClient(new DelegateAuthenticationProvider((requestMessage) => {
                    requestMessage
                        .Headers
                        .Authorization = new AuthenticationHeaderValue("bearer", token);

                    return Task.FromResult(0);
                }));

                var events = await graphServiceClient.Users["[email protected]"].Events.Request().GetAsync();


            }
            catch (MsalServiceException ex)
            {
                // Case when ex.Message contains:
                // AADSTS70011 Invalid scope. The scope has to be of the form "https://resourceUrl/.default"
                // Mitigation: change the scope to be as expected
            }

What am I doing wrong here? I have already granted permission to Calendars.Read in azure portal while registering my app there: https://www.screencast.com/t/jTjnB4SX5I

I tried that too but same result. Started giving The scope Calendars.Read is not valid. — tavier
Ah, missed that you're doing client credential flow. In that case, try using just the scope https://graph.microsoft.com/.default. — Jason Johnston
I actually had tried that and got the access token :) but when I use that token to read the calendar events for a user I get this error: "Code: NoPermissionsInAccessToken, Message: The token contains no permissions, or permissions can not be understood." — tavier
My code where I am trying to get the events: var graphServiceClient = new GraphServiceClient(new DelegateAuthenticationProvider((requestMessage) => { requestMessage .Headers .Authorization = new AuthenticationHeaderValue("bearer", token); return Task.FromResult(0); })); var events = await graphServiceClient.Users["[email protected]"].Events.Request().GetAsync(); — tavier

Jason Johnston Jason Johnston · Accepted Answer · 2019-06-26T16:47:18

A couple of things are going on here.

When you use the client credentials flow, you're required to use a scope of the form {resource}/.default, where {resource} is the URL of the thing you want access to. In this case, your scope should be https://graph.microsoft.com/.default. (Source)
You have not configured any application permissions on your app registration. From your screenshot, you've only configured delegated permissions, which are user permissions that require a logged in user. Add Calendars.Read as an application permission and that should get you going.

"The scope https://graph.microsoft.com/Calendars.Read is not valid" error while getting access token for my app

1 Answers