Search code examples
azureazure-devopsazure-active-directory

Why are there multiple api endpoints for azure oauth?

What is the difference between:

  • https://login.microsoftonline.com/common/oauth2/v2.0/token
  • https://login.microsoftonline.com/organizations/oauth2/v2.0/token
  • https://login.microsoftonline.com/{Directory ID}/oauth2/v2.0/token

Using common (the first endpoint) seems to work fine for generating my tokens?

Solution

  • When you register an application in Azure AD, you are asked to choose the account types that can use the application.

    enter image description here

    The endpoints essentially corresponds to these.

    • https://login.microsoftonline.com/common/oauth2/v2.0/token: You can use common endpoint to authenticate/authorize any account (Personal Microsoft Account or Work/School Account).
    • https://login.microsoftonline.com/organizations/oauth2/v2.0/token: When you use organizations endpoint, only Work/School Account can be authenticated. Personal Microsoft Accounts cannot be authenticated/authorized.
    • https://login.microsoftonline.com/{Directory ID}/oauth2/v2.0/token: When you specify the directory id (also known as Tenant Id) in the endpoint, only Work/School Accounts in that tenant can be authenticated/authorized. Personal Microsoft Accounts and Work/School Accounts in other tenants cannot be authenticated/authorized unless they are added to the tenant as guest users.