Search code examples
azureazure-active-directoryazure-web-app-service

Azure AD how to expose API to users?

I followed a Microsoft tutorial on how to create an SPA and API and use MSAL to secure it (https://github.com/Azure-Samples/ms-identity-javascript-react-tutorial/tree/main/3-Authorization-II/1-call-api).

But they ask to expose the API like this:

For the Scope name, use Todolist.Read. Select the Admins and Users options for Who can consent?. For the Admin consent display name, type in scopeName. For the Admin consent description, type in e.g. "Allows the app to read the signed-in user's files.". For the User consent display name, type in scopeName. For the User consent description, type in e.g. "Allows the app to read your files.".

However, I can't find where I can change the 'Who can consent?' options.

So, when I create a new scope, I can change the Admin scope name and description, but there's no 'Who can consent?' option available. adding a new scope

And when the scope is created, I can't change it either; it says "Admins only." scope

Solution

  • When I tried to expose an API scope in B2C tenant application, I also cannot find Who can consent? option:

    enter image description here

    You need to switch your directory to normal Azure AD tenant and make it as current directory like below:

    enter image description here

    In that Azure AD tenant, I registered one application named msal-node-api and exposed an API scope where I can see "Who can consent?" option:

    enter image description here

    Now, I created another app registration named msal-react-spa and added above permissions in it:

    enter image description here

    When I ran the sample following same document, I got below screen after successful authentication:

    enter image description here