How do you get an access token from azure active directory (V2) to allow access to Azure Service Bus?

1
votes

I've been following the this tutoral to get an access token for azure service bus so that I can post messages to a queue using Postman:

https://docs.microsoft.com/en-us/rest/api/servicebus/get-azure-active-directory-tokenTh

Following the example through works and I can get an access token. However, the example uses the older v1 token endpoints eg

https://login.microsoftonline.com/{{tennant-id}}/oauth2/token

I want to use the current v2 endpoint eg

https://login.microsoftonline.com/{{tennant-id}}/oauth2/v2.0/token

But when I switch get this error:

AADSTS70011: The provided request must include a 'scope' input parameter. The provided value for the input parameter 'scope' is not valid. The scope https://servicebus.azure.net is not valid.

I'm assuming that the name of the scope must have changed and I cannot find any documentation about what scopes are for azure services. I've tried a bunch of things such as https://servicebus.windows.net and https://myqueue.servicebus.windows.net and googling but I've found nothing.

Update

Following on from the answers provided I have appended ".default" to the requested scope. This hasn't solved to the problem but has changed the error message I now get Error: invalid_client in the postman console.

I'm trying with the postman "get new access token" feature and have set it like this

[Postman screensshot1

Update 2

Grant type was wrong in the last update - should be client credentials then it will work.

2
azureazure-active-directoryazureservicebusmicrosoft-identity-platform
Any update this issue? – Joy Wang-MSFT
@JoyWang I've not got it working yet but updated the question with the progress. I'm trying to find documentation for ".default" to see if it needs other roles assigning to the service principle beyond the ones covered in that article. – Twisted
From the screenshot, the Grant Type is Authorization Code, it is the auth code flow, in the doc you referred to, it uses the client credential flow, you need to change it to Client credentials. – Joy Wang-MSFT
uurgh - thanks @JoyWang – Twisted

2 Answers

3
votes

When using v2.0 endpoint of the client credential flow, you need to use scope instead of resource in the request body, and pass the /.default to the url, it should be https://servicebus.azure.net/.default.

Sample:

enter image description here

2
votes

Mostly you might have missed to add .default in the scope parameter. Please try appending .default that is https://servicebus.azure.net/.default for scope parameter value.