Using personal account (live.com) to get an access token for my app

0
votes

I am having trouble getting an access token using the password grant auth end point.

I created an app registration in my Azure account which is tied to my personal live.com Microsoft account.

In the application settings I've set the supported account types to AzureADandPersonalMicrosoftAccount (Accounts in any organizational directory (Any Azure AD directory - Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox))

When I attempt to to authorize via my personal account's username/password using the https://login.microsoftonline.com/{{TenantId}/oauth2/v2.0/token end point using grant_type=password I get the following error:

AADSTS50034: The user account {EmailHidden} does not exist in the xxx-xxx directory. To sign into this application, the account must be added to the directory.

I am not sure how this is possible as I am obviously the only member of my Azure AD.

enter image description here

The app, Todo Inventory is listed under the applications in the user profile as shown below:

enter image description here

Note that I am successfully able to get an access token using the auth code flow described in the documentation here: https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow

But I want to use the password grant instead but nothing I tried seem to be working.

Am I missing something here..?

1
azure-active-directorymicrosoft-graph-apiaccess-token

1 Answers

1
votes

Microsoft identity platform doesn't support resource owner password flow for personal accounts. https://docs.microsoft.com/azure/active-directory/develop/v2-oauth-ropc

The Microsoft identity platform endpoint only supports ROPC for Azure AD tenants, not personal accounts. This means that you must use a tenant-specific endpoint (https://login.microsoftonline.com/{TenantId_or_Name}) or the organizations endpoint.