Exchanging Access Tokens for two Azure Apps for Graph APIs

No. An access token or refresh token issued for AppID1 cannot be exchanged to obtain tokens for AppID2.

Key points:

1. Tokens are bound to a client (app registration)
   • In the authorization code flow, the token endpoint issues an access token and (optionally) a refresh token to a specific client_id (the app registration).
   • The refresh token returned in Step 2 is explicitly tied to the app that requested it and to the scopes that were consented for that app.
   • When using a refresh token, the app must call the /token endpoint again with its own client_id and client_secret (for confidential clients) and grant_type=refresh_token.
   • A refresh token acquired by AppID1 cannot be presented as if it belonged to AppID2.
2. Supported use of refresh tokens
   • The documented pattern is:
     • Step 2: App uses the authorization code to request an access token and (optionally) a refresh token.
     • Step 4: The same app later calls /token with grant_type=refresh_token and its own client_id to get a new access token (and a new refresh token) for the same app.
   • The documentation does not describe any flow where a refresh token from one client can be used to obtain tokens for a different client.
3. Required pattern for multiple apps
   • If both AppID1 and AppID2 need delegated access on behalf of the same user, each app must obtain its own authorization code and tokens via an interactive sign-in at least once.
   • In production, this is typically handled by using a single client app (or a shared backend) with appropriate scopes, or by using a Microsoft Authentication Library (MSAL) and a single app registration where possible, rather than trying to exchange tokens between separate app registrations.
4. Recommended approach
   • Use MSAL or another supported authentication library to manage tokens and Single Sign-On (SSO) for the user across your components, instead of attempting token exchange between app registrations.
   • If a backend service needs to call Microsoft Graph on behalf of the user, design the architecture so that the same app registration (client) is used for the delegated flow, or use on-behalf-of flow within a single logical application rather than between unrelated app registrations.

There is no supported mechanism in the Microsoft identity platform to take an access or refresh token issued to AppID1 and exchange it for tokens for AppID2 without a user sign-in/consent flow for AppID2.

References:

• Get access on behalf of a user
• Generate an auth token
• Get a token for a mobile app that calls web APIs