knownClientApplications in Azure AD App doesn't work

4
votes

I have a problem with consenting to my API. I have 2 apps in my tenant (Client, API). Client app is SPA and implicit flow is enabled and it calls API, so I added Client application's id into knownClientApplications in API application. For both applications multi-tenant is enabled.

But when I try to login in my SPA from different tenant I'm only asked for Client application consent and get an error that I don't have service principal for my API application.

What should be configured in order for this to consent implicitly to API application too?

I use MSAL.js library and Azure AD 2.0. Scope: https://mytenantname.onmicrosoft.com/myservicename/user_impersonation

1
azure-active-directorymsal

1 Answers

1
votes

For the SPA application to prompt consent combined with your API consents, your scope should be https://mytenantname.onmicrosoft.com/myservicename/.default.

You can read about ./default scope here.

If you need a sample to clarify this concept, I would suggest this one