Question 104418 in Azure Question posted in
The official documentation to get you started can be found here.

Azure – Invoke-RestMethod :unauthorized client for getting Authentication-token

I have created app registration in azure active directory. I’m trying to invoke an azure ad authenticated with below PowerShell script, but it always display an error:

$clientID = '<clientID>'
$secretKey = '<key>'
$tenantID = '<TenantID>'

$password = ConvertTo-SecureString -String $secretKey -AsPlainText -Force
$credential = New-Object System.Management.Automation.PSCredential($ClientID,$password)
Connect-AzureRmAccount -ServicePrincipal -Credential $credential -Tenant $tenantID

$authUrl = "https://login.microsoftonline.com/" + $tenantID + "/oauth2/v2.0/token/"
$body = @{
   "scope" = "api://a193b314b-7854-9aab-bb78-6a50ffxxxxxx/";
   "grant_type" = "client_credentials";
   "client_id" = $ClientID
   "client_secret" = $secretKey
}

Write-Output "Getting Authentication-Token" 
$adlsToken = Invoke-RestMethod -Uri $authUrl –Method POST -Body $body
Write-Output $adlsToken

I am getting this error. please make me to understand Why I am getting this error

Invoke-RestMethod:
{"error":"invalid_scope","error_description":"AADSTS1002012: The provided value for scope api://3e3643c5-90af-ece is not valid. Client credential flows must have a scope value with /.default suffixed to the resource identifier (application ID URI).rnTrace ID:2d4f23bf-b317-4d5c-b5xxxxxrnCorrelation ID:fe5945b4-b2c2-4814-9xxxxxxxrnTimestamp:04:26:09Z","error_codes":[1002012],"timestamp":"2022-11-19
04:26:09Z","trace_id":"2d4f23bfb3174d5cb5a7xxxxxxx","correlation_id":"fe5945b4-b2c2-4814-99xxxxxxxx"}

Connect-AzAccount: ClientSecretCredential authentication failed:
AADSTS700016: Application with identifier
‘3e3643c5-90af-4af6-afxxxxxxx’ was not found in the directory ‘Default

Tags:

2

Answers


  1. 0

    Can you try this by adding .default in scope,

    "scope" = "api://a193b314b-7854-9aab-bb78-6a50ffxxxxxx/.default"

    If it works, see the reference.

    Login or Signup to reply.
  2. 0

    I tried to reproduce the same in my environment I got the same error as below:

    enter image description here

    To resolve this issue, check whether you are providing correct ClientID as below:

    enter image description here

    And, In scope the error mention you have missed /.default Make sure to include /.default like below:

    "api://xxxxxx/.default";

    When I ran the same script along with scope default, I got the Result successfully like below:

    enter image description here

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search