Search code examples
azure-active-directorymsal.js

How to get 'user_impersonation' scope for a token

I create an application in Azure Active directory via Azure portal. And I have 'Request API permission' for 'user_impersonation'.

enter image description here

In my JS code which uses msal.js library, I tried requested token using this scope, but I don't get any token back.

   scopes: ["user_impersonation"]

But if I use

scopes: ["User.Read"]

or

scopes: [.default]

I get a token back.

Solution

  • I tried to reproduce your issue getting the same situation like you as user_impersonation scope name could be anything you because it is a custom scope, as long as your code check for that same scope name that you created.

    Conclude from this github discussion, there might be still sync issue from MS end. You can raise a GITHUB request for the same or you can reach out to AzureSuport Team also.

    scope is Application ID URI from Expose an API followed by /.default. Without /.default you will get an error like:

    enter image description here

    Tried with OAuth2 permissions scopes with changing the Application manifest but didn’t help.

    To get this working, you would either have to use ./default, or if trying to specify specific permission, it has to be application permission for it to work with Client_Credentials flow.

    enter image description here

    For me I am not able to give application permission for my custom scope which I have created in Exposed API and with delegated permission getting the same error. Try if you can give application permission.

    enter image description here