Microsoft Graph Access Token Rejected with IDX14100 Despite Valid OAuth Token Response

Issue Summary

We are integrating Microsoft Graph Calendar APIs using Microsoft Entra ID OAuth 2.0.

Our application uses the /common authority because we need to support both personal Microsoft accounts and organizational Microsoft 365 accounts.

The OAuth authorization-code flow completes successfully, and the Microsoft token endpoint returns an access token with the requested Microsoft Graph calendar permission.

However, when we use the returned access_token to call Microsoft Graph, Graph returns 401 Unauthorized with:

InvalidAuthenticationToken
IDX14100: JWT is not well formed, there are no dots (.).
The token needs to be in JWS or JWE Compact Serialization Format.

OAuth Configuration

Authorization endpoint:

https://login.microsoftonline.com/common/oauth2/v2.0/authorize

Scopes:

openid
offline_access
email
https://graph.microsoft.com/Calendars.ReadBasic

The token endpoint returns:

{
    "token_type": "Bearer",
    "scope": "openid email https://graph.microsoft.com/Calendars.ReadBasic",
    "expires_in": 3599,
    "ext_expires_in": 3599,
    "access_token": "EwA4BMl6BAAUCBUz0PacyGyQMzAdZCXlnFTa1qQAA...",
    "refresh_token": "...",
    "id_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1Ni..."
}

The access_token returned by Microsoft starts with EwA4... and does not contain . characters, so it is not a JWT.

We are passing this token directly to Microsoft Graph as a Bearer token. We are not modifying, decoding, or transforming the access token.

Microsoft Graph Request

We are calling:

POST https://graph.microsoft.com/v1.0/users/{userPrincipalName}/calendar/getSchedule
Authorization: Bearer <access_token>
Content-Type: application/json

Graph responds with:

HTTP 401 Unauthorized

In one occurrence, Graph returned:

{
    "error": {
        "code": "InvalidAuthenticationToken",
        "message": "IDX14100: JWT is not well formed, there are no dots (.). The token needs to be in JWS or JWE Compact Serialization Format."
    }
}

Another occurrence returned HTTP 401 with an empty body.

Graph Request Information

Request ID:

6c288a64-6461-4150-81a9-3f27ded3ccc1

Client Request ID:

6c288a64-6461-4150-81a9-3f27ded3ccc1

Timestamp:

2026-09-03 12:35:17 UTC

Data center:

Central India

Additional Information

The returned id_token is a normal JWT and can be parsed successfully. The access_token, however, is opaque and does not have the normal JWT structure.

We understand that Microsoft Entra access tokens are not necessarily required to be JWTs and that applications should generally treat access tokens as opaque.

Our concern is that the token is issued by the Microsoft token endpoint specifically with:

https://graph.microsoft.com/Calendars.ReadBasic

as its scope, but Microsoft Graph subsequently attempts to parse the token as a JWT and rejects it because it contains no dots.

We would like Microsoft to confirm:

Whether an opaque EwA... access token is expected for this OAuth flow and Microsoft Graph resource.

Whether Microsoft Graph should accept this token format for the requested Graph permission.

Why Graph is attempting to validate this token as a JWT when the token was issued by the Microsoft identity platform for Graph.

Whether there is a known issue with token issuance or Graph token validation for this flow.

Whether there is a supported way to request a Graph JWT access token for this scenario, if required.

Whether this behavior is related to using the /common authority.

We can provide the full sanitized OAuth request/response and additional Graph request IDs if required.

Important Security Note

The actual access token and refresh token are intentionally not included in this support ticket. They can be provided only through Microsoft's secure support channels if required.