Search code examples
azureoauth-2.0azure-active-directoryazure-service-principal

Adding permissions to an application in Azure app registration

I'm currently learning about Azure app registrations, and there is something I don't quite understand. The docs in Quickstart: Configure a client application to access a web API say that the "Configured permissions" in the API Permissions of an app registration is basically a list of all the permissions that your application requires for basic operation. The exact quote:

The Configured permissions table on the API permissions pane shows the list of permissions that your application requires for basic operation - the required resource access (RRA) list. Users, or their admins, will need to consent to these permissions before using your app. Other, optional permissions can be requested later at runtime (using dynamic consent).

additionally, it states that:

Whenever you configure permissions, users of your app are asked at sign-in for their consent to allow your app to access the resource API on their behalf.

Now, I have tried following the Python quickstart demo, which signs-in a user and accesses the MicrosoftGraph API: https://github.com/Azure-Samples/ms-identity-python-webapp

In this walkthrough, I have registered my app (MyClientApp) in Azure app registration, and for testing, I've added some scopes from Microsoft Graph in the API Permissions pane, such as enter image description here

Now, when I run the application and attempt to sign in, the user consent prompt is prompted to me, but it doesn't request for permissions for any of the above scopes. It gives me:

enter image description here

Can someone clear out the fog?

Solution

  • Without looking at the sample, I think it is not requesting an access token in that request. The client is only requesting an ID token (with something like scope=openid+profile).

    You need to specify e.g. https://graph.microsoft.com/.default as a scope when authenticating the user to get an access token. In this case we use the special ".default" scope that tells AAD "just use the ones in the app registration". Alternatively you could ask for e.g. https://graph.microsoft.com/AccessReview.Read.All scope to require that permission.

    One thing to note here though. If your client app used the v1 authorization endpoint, those configured permissions would be required. But I assume the app is using MSAL and the v2 endpoint, which allows these dynamic permission requests.