Question 296092 in Azure Question posted in
The official documentation to get you started can be found here.

Azure – Graph API failure in fetching sites

I had a graph app created on Azure and it was running fine, the secret just expired so i created a new one. Now im not able to fetch sites using graph API with the following error:

 errorcode: AccessDenied, message: Either scp or roles claim need to be present in the token.

Nothing has changed in terms of permissions, i confirmed my App has both Application and Delegate permissions
PERMISSIONS

The only thing changed is i created a new secret and now using that, what could be the issue

Tags:

2

Answers


  1. Chosen as BEST ANSWER
    0

    Fixed: I was using the token generated by REST to query the graph API which wasn't working.


  2. 0

    The error "AccessDenied, Either scp or roles claim need to be present in the token" usually occurs if the access token doesn’t contain any scope or claims to perform the action.

    Note that: If you are using Client Credential flow, then grant application API permissions. If you are using interactive flow, then make use of delegated API permissions to generate the access token.

    I created an Azure AD application and granted API permissions same as you:

    enter image description here

    Generated access token using Client credential flow by using below parameters via Postman:

    https://login.microsoftonline.com/TenantID/oauth2/v2.0/token

client_id:ClientID
client_secret:ClientSecret
scope:https://graph.microsoft.com/.default
grant_type:client_credentials

    enter image description here

    Make sure to decode the access token in jwt.ms and check if the roles or scopes are present:

    enter image description here

    By using the above access token, I am able to fetch the sites successfully:

    GET https://graph.microsoft.com/v1.0/sites

    enter image description here

    If still the issue persists, check the below:

    • Make sure to grant admin consent to the API permissions.
    • Make sure that the roles or scopes are present in the access token by decoding it.
    • Creating a new secret and passing it to generate access token is normal and doesn’t cause an error.
    • Try generating the access token again and check.
    • Make sure the access token is not expired.
    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search