Token Generation failed

Radha Rajendran 61 Reputation points
2021-03-25T17:41:12.583+00:00

Hi Team,

Token generation using username and password works but not with "Client_credentials"
Geting below error.

{
"error": "invalid_scope",
"error_description": "AADSTS70011: The provided request must include a 'scope' input parameter. The provided value for the input parameter 'scope' is not valid. The scope api://241cff78-cbb9-44bf-bd58-13e18bf55170/Files.Read is not valid.\r\nTrace ID: 753902ca-0c2f-4be8-9ebf-6fa018ccc600\r\nCorrelation ID: 40edfa41-4212-48bb-9425-dd13ac57091c\r\nTimestamp: 2021-03-25 17:39:40Z",
"error_codes": [
70011
],
"timestamp": "2021-03-25 17:39:40Z",
"trace_id": "753902ca-0c2f-4be8-9ebf-6fa018ccc600",
"correlation_id": "40edfa41-4212-48bb-9425-dd13ac57091c"
}

Do we need to make any additional configuration or settings?

Microsoft Security | Microsoft Entra | Microsoft Entra ID
0 comments

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Khurram Rahim 1,861 Reputation points Volunteer Moderator
    2023-02-10T22:27:19.0833333+00:00

    The error message "The provided request must include a 'scope' input parameter" indicates that the request to generate an access token using client credentials is missing the required scope parameter. The scope defines the permissions that the access token will have to access resources.

    In order to fix the issue, you need to ensure that the correct scope is included in the request to generate the access token. You should check the documentation of the API you are trying to access to determine what the correct scope is.

    You can also check the Azure Active Directory (AAD) App registration for the API to see if the required scope is properly configured. If it is not, you may need to add the scope to the AAD App registration.

    Additionally, make sure that the client credentials (client ID and secret) being used are correct and have the required permissions to access the API with the specified scope.

    Was this answer helpful?

    1 person found this answer helpful.
  2. Radha Rajendran 61 Reputation points
    2021-03-26T13:38:30.63+00:00

    Hi @James Hamil , Any solution please.

    Was this answer helpful?

    0 comments
  3. Anonymous
    2021-03-25T18:48:31.077+00:00

    Hi @Radha Rajendran , from this thread:

    You are using the client credential flow here, which means that you cannot dynamically request scopes. You must configure your required permission scopes on your app registration in apps.dev.microsoft.com, then you set the value of scope in your code to https://graph.microsoft.com/.default.

    See https://developer.microsoft.com/en-us/graph/docs/concepts/auth_v2_service for more details.

    I believe this is the answer to your problem. If so, please mark this answer as "Verified" so other users may reference it. If not, please let me know and I can look into this further!

    Best,
    James

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.