Issue with OBO authentication flow

@Rukmini yes for both, just checked again.

Just to be sure it's Enterprise applications > [app name] > Security > Permissions and App Registrations > [app name] > Manage > API permissions right? Is there something more?

@Clarissa De Simoni

Could you please verify the following:

1. Is the frontend application's Client ID listed under the backend app registration's Known client applications section in the manifest (knownClientApplications)?
2. During the OBO token exchange, are you using the frontend access token as the assertion parameter and requesting Microsoft Graph scopes (for example https://graph.microsoft.com/.default)?
3. Does the backend app registration have the required delegated Microsoft Graph permissions (not only application permissions) with admin consent granted?
4. Can you decode the incoming frontend token and confirm it contains an scp claim with user_impersonation?

@Rukmini Yes, the results are as follows:

1. Yes (knownClientApplications is under api right?)
2. Yes, the flow is as follows:
   1. I defined the scopes as api://${backendClientId}/user_impersonation and offline_access.
   2. in the frontend I requested the token with the following line (surrounded by a try-catch block):

            const result: AuthenticationResult = await instance.acquireTokenSilent({
            	scopes: backendApiScopes.scopes,
            	account,
            });
            return result.accessToken;
      

   3. I send a request to my backend using fetch:

            
            const authFetch = useCallback(async (url: string, options: RequestInit = {}): Promise<Response> => {
            	const token = await getBackendToken();
            	return fetch(url, {
            		...options,
            		headers: {
            			...(options.headers ?? {}),
            			Authorization: `Bearer ${token}`,
            			"Content-Type": "application/json"
            		}
            	})
            }, [getBackendToken]);
      

   4. in the backend I verify the JWT token and get the OBO credentials i need for the agent as follows:

            async def get_current_user(credentials: HTTPAuthorizationCredentials = Depends(bearer_scheme)) -> AuthenticatedUser:
                token = credentials.credentials
                claims = validate_jwt(token)
                enforce_scopes(claims)
                credential = get_obo_credential(token)
                return AuthenticatedUser(claims, credential)
            
            def get_obo_credential(user_token: str) -> OnBehalfOfCredential:
                return OnBehalfOfCredential(
                    tenant_id=e.AZURE_TENANT_ID.value,
                    client_id=e.AZURE_BACKEND_CLIENT_ID.value,
                    client_secret=e.AZURE_BACKEND_CLIENT_SECRET.value,
                    user_assertion=user_token,
                )
      

If I use ConfidentialClientApplication to generate the token for the user_assertion (based on user_token) I get the following error: OnBehalfOfCredential.get_token_info failed: Authentication failed: AADSTS50013: Assertion failed signature validation. [Reason - Key was found, but use of the key to verify the signature failed., Thumbprint of key used by client: '<thumbprint>', Found key 'Start=<XXX>, End=<XXX>', Please visit the Azure Portal, Graph Explorer or directly use MS Graph to see configured keys for app Id '00000000-0000-0000-0000-000000000000'. Review the documentation at https://docs.microsoft.com/en-us/graph/deployments to determine the corresponding service endpoint and https://docs.microsoft.com/en-us/graph/api/application-get?view=graph-rest-1.0&tabs=http to build a query request URL, such as 'https://graph.microsoft.com/beta/applications/00000000-0000-0000-0000-000000000000']. Trace ID: 548edf40-9155-4751-a8f7-b630e0a40f00 Correlation ID: ec971cf6-1e35-4f9d-ab32-005ce0bee998 Timestamp: 2026-06-03 07:47:29Z

1. I compute the answer using the information in AuthenticatedUser (a utility class I created) and send the response to the frontend
2. Yes, I also have delegated permissions and all of them have admin consent granted
3. Yes. I used jwt.ms and I can confirm scp: "scp": "user_impersonation"

@Rukmini do you have any other suggestions please?

Hello @Clarissa De Simoni We will investigate the issue and update you with the findings. Thank you for your patience as we look into this.