Either scp or roles claim need to be present in the token using when application permissions to read sharepoint sites

Question

I created an app in Azure and set it up to use Access and ID tokens.

I want to connect to different tenants and read SharePoint sites. Here are the permissions I've requested and received Admin Consent for:

For now, I have set up an App Secret but I do plan to move to a certificate later.

I have this code to get the access token and I do get an access token back:

const params = new URLSearchParams();
params.append("grant_type", "client_credentials");
params.append("scope", "https://graph.microsoft.com/.default");
params.append("client_id", process.env.client_id);
params.append("client_secret", process.env.client_secret);

var url = `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/token`;
const response = await fetch(url,
    {
        method: 'POST',
        body: params,
        headers: { 'Content-Type': 'application/x-www-form-urlencoded' }
    }
);

However when I try to read the root site below

var url = "https://graph.microsoft.com/v1.0/sites?search=*";
const response = await fetch(url,
    {
        method: 'GET',
        headers: { 'Authorization': `Bearer ${access_token}` }
    }
);

I get this error:

error: { 
    code: 'AccessDenied',
    message: 'Either scp or roles claim need to be present in the token.',
    innerError: { 
        'request-id': 'ec47913f-2624-4d1c-9b27-5baf05ccebfd',
        date: '2019-08-16T14: 15: 37'
    }
}

I checked the token at https://jwt.io/ and indeed I do not see any entry for roles or scp.

It looks like I missed a step but I cannot figure out which step.

I am getting the token like this:

https://login.microsoftonline.com/${tenant}/oauth2/v2.0/token

What am I doing incorrectly?

Marc LaFleur Marc LaFleur · Accepted Answer · 2019-08-16T16:02:32

The first thing to understand is that you cannot receive both Application and Delegated permissions in the same token, it is an either/or scenario. Which type you receive depends entirely on which OAuth Grant you used to request the token:

Authorization Code and Implicit return Delegated tokens with an scp property
Client Credentials return Application tokens with a roles property

The second thing is that you've requested scopes to two different APIs. Based on what you've selected, you won't have access to SharePoint through the Microsoft Graph because you've only requested access to the legacy SharePoint API. More importantly, you've only requested the Delegated User.Read scope for Graph so when you use Client Credentials to obtain the token, that token won't have any permissions.

In order to obtain an Application token for reading SharePoint sites, you'll need Sites.Read.All Microsoft Graph Application permission selected.

Either scp or roles claim need to be present in the token using when application permissions to read sharepoint sites

1 Answers