Search code examples
azure-active-directory

How to retrieve a list of OAuth scopes for authorized Azure AD applications using Microsoft Graph API?

To clarify, I have limited knowledge about Azure AD. I'm trying to make a list of the OAuth scopes for applications that users have authorized. For example, when a user clicks on "Login with Microsoft," an application might request access to view the user's identity, read their email, or access their OneDrive files.

In Google Workspace, you can find this information using the following link: https://developers.google.com/admin-sdk/directory/reference/rest/v1/tokens?hl=en

I would appreciate any guidance. I have created a Developer Account in Microsoft 365 and have used several applications, but I have not been able to find a user interface or method using the Microsoft Graph API to obtain this information.

Solution

  • I tried to reproduce the same in my environment and got the results like below:

    I created an Azure AD Application and granted API permissions:

    enter image description here

    In the Azure Enterprise Applications, search your application and copy the ObjectID of Service Principal:

    enter image description here

    To list the OAuth scopes for authorized Azure AD applications, try the below:

    GET https://graph.microsoft.com/v1.0/servicePrincipals/ServicePrincipalObjID/oauth2PermissionGrants

    enter image description here

    Output:

    {
"@odata.context": "https://graph.microsoft.com/v1.0/$metadata#oauth2PermissionGrants",
"value": [
{
"clientId": "xxxx",
"consentType": "AllPrincipals",
"id": "xxxx",
"principalId": null,
"resourceId": "xxxx",
"scope": "profile offline_access User.Read openid email"
}
]
}

    For example, when a user clicks on "Login with Microsoft," an application might request access to view the user's identity, read their email, or access their OneDrive files.

    To achieve your scenario, create an Azure AD Application and assign the required API permissions:

    enter image description here

    To sign-in the user to the Application, I generated authorization code by using below endpoint:

    https://login.microsoftonline.com/TenantID/oauth2/v2.0/authorize?
&client_id=ClientID
&response_type=code
&redirect_uri=https://jwt.ms
&response_mode=query
&scope=https://graph.microsoft.com/.default
&state=12345

    enter image description here

    The auth code got generated successfully like below:

    enter image description here

    By using the below parameters, I generated the access token like below:

    https://login.microsoftonline.com/TenantID/oauth2/v2.0/token

client_id:ClientID
grant_type:authorization_code
scope:https://graph.microsoft.com/.default
code:code
redirect_uri:https://jwt.ms
client_secret:ClientSecret

    enter image description here

    When I decoded the token, the scopes are like below:

    enter image description here

    By using the above access token, you can call the APIs like below:

    To get the signed-in user details, I used below query:

    https://graph.microsoft.com/v1.0/me

    enter image description here

    You can configure the graph queries in your code and access them based on your requirement.