What Scope and or resource to set to get token that works with office 365 api?

Question

We have acquired the Admin consent in both delegated and application ServiceHealth.Read permissions in Office 365 Management API for our Client app in Azure AD.

We are unable to figure out what the scope and or resource needs to be in token acquisition process if we want to make calls to the office365 management api.

Whether its the client_credentials grant method of direct token acquisition

Or the authorization code then token for signed-in user method

It would be preferable if its for the client_credentials grant method, but if it has to be through auth code, that's fine too.

We can use the following already to grab our reports but do not know how to allow that authentication to also cover Office365 Management API Service Health

curl --location --request GET "https://login.microsoftonline.com/{tenantid}/oauth2/v2.0/token" \
--header "Content-Type: application/x-www-form-urlencoded" \
--data "client_id={clientid}&client_secret={clientsecret}&scope=https://graph.microsoft.com/.default&grant_type=client_credentials"

When adding ServiceHealth.Read to the end or by itself it returned invalid_scope as an error

When place only https://manage.office.com/ServiceHealth.Read/.default in the scope it gives the error invalid_resource with the description including that the resource not found in tenant

A similar problem occurred when trying to get the authorization code and setting the resource as ServiceHealth.Read and while setting that as the scope instead gave a authorization code, the resulting token was deemed invalid.

Answer 1

Authorization Code Grant Flow

I quickly tried this out with an Azure AD app registration that has ServiceHealth.Read delegated permission for Office 365 Management APIs.

Scope value used - https://manage.office.com/ServiceHealth.Read

I was able to successfully get back an access token following the Authorization Code Grant flow. I'll share the detailed request parameters passed shortly, but this should answer your direct question about what scope value to use.

Since I used Azure AD V2 endpoints, I didn't really need to specify a resource. In your sample requests mentioned in question I see that you are also using Azure AD V2 endpoint.

Detailed steps

Step 1 - Get the Authorization Code

For this step, I directly used browser and then sign in using a valid user from my Azure AD tenant.

// Line breaks only for clear reading. Remove line breaks and paste in browser URL to test.

https://login.microsoftonline.com/mytenant.onmicrosoft.com/oauth2/v2.0/authorize?
client_id=29a95b.....
&response_type=code
&redirect_uri=https://rohitapp/
&response_mode=query
&scope=https://manage.office.com/ServiceHealth.Read
&state=12345

Response should be something like

https://rohitapp/?code=
OAQABAAIAAACQN9QBRU....
&state=12345&session_state=f5da06....

Step 2 - Acquire Token from token endpoint

Take the Authorization code from last step.

For this step I used POSTMAN. You can use CURL as well.

POST https://login.microsoftonline.com/mytenant.onmicrosoft.com/oauth2/v2.0/token
Content-Type: application/x-www-form-urlencoded

Request Body

client_id=29a95b....
&scope=https://manage.office.com/ServiceHealth.Read
&code=OAQABAAIAAACQN9QBRU....
&redirect_uri=https://rohitapp/
&grant_type=authorization_code
&client_secret=Aj....

Final Token received, decoded in https://jwt.ms

Client Credentials Grant Flow

Scope value used - https://manage.office.com/.default

I did add the related app permission and give consent for it.

For this one I used POSTMAN again. You can use CURL as well.

POST https://login.microsoftonline.com/mytenant.onmicrosoft.com/oauth2/v2.0/token
Content-Type: application/x-www-form-urlencoded

Request Body

client_id=29a95....
&scope=https://manage.office.com/.default
&grant_type=client_credentials
&client_secret=Aj....

Final Token received, decoded in https://jwt.ms

Take a look at this Microsoft documentation around scope value for Client Credentials Grant.