Search code examples
azure-active-directoryazure-bot-serviceazure-authentication

What is the token returned by the Azure Bot?

I followed this tutorial to setup authentication for my Azure Bot. After a successful login, it returns a token for me. I believe that this is an authorization token to access the Microsoft Graph API. If I wanted to use this same token to exchange for an access token to another web application, is that possible? And how would I be able to do it?

Solution

  • Yes, it's possilbe.

    You should be able to get a refresh_token after the authorization is finished.

    Use this refresh_token to exchange another access_token with the scope of another web application. Like this:

    enter image description here

    Then we can get an access_token for another scope:

    enter image description here

    You can see that the scope has changed from https://graph.microsoft.com to api://{id}/user.write which is another web API.

    UPDATE:

    Maybe I have a misunderstanding because I see you want to exchange a new access token.

    If you just want to access your own web api from Bot application and don't need to call Microsoft Graph API, just modify the Resource URL (Azure AD v1) or Scopes (Azure AD v2). It's unnecessary to exchange a new access token.

    For Azure AD v1, you should set Resource URL as: api://{api id}.

    For Azure AD v2, set Scopes as: api://{api id}/.default.

    Please note that api://{api id} is your web api.