Azure access token generation from Postman for delegated scopes

I wanted to generate Azure token from Postman for API authorization in my project. I am able to generate token using below API request but getting the below error message while using the generated token in another API request.

> "Authorization denied for this request"

I have referred the below URL:
https://stackoverflow.com/questions/56954067/azure-access-token-generation-from-postman

The problem is with the generated token. I tried to verify token on the JWT.io site. As per find we are not getting any scope added in the generated token.

I'm currently Scopes with delegated permission. Please suggest what should I do?

Endpoint#

 https://login.microsoftonline.com/:tenant_id/oauth2/token

Params#

tenant_id:As per id generation by azure.

Header#

Content-Type: application/x-www-form-urlencoded

Body# (Form-data)

grant_type:client_credentials
client_id:As per id generation by azure.
client_secret:As per id generation by azure.
resource:Required URL

Response#

"token_type": "Bearer",
"expires_in": "foo",
"ext_expires_in": "foo",
"expires_on": "foo",
"not_before": "foo",
"resource": "foo",
"access_token":foo

> Note that: For delegated scopes, you have to generate token using any user Interactive Flow (Authorization code flow/Implicit Flow) and for application scopes make use of client credential flow.

I tried to reproduce the same in my environment and got the same error as below:

To error usually occurs if the access token doesn't have sufficient permissions to perform the action.

To resolve the error, try the below:

Make sure to add the API permissions based on your requirement:

Now, Generate the auth-code by using below endpoint:

https://login.microsoftonline.com/6c3f1c39-b84c-4188-b49f-ca5e806be058/oauth2/v2.0/authorize?
&client_id=b08f06ad-bb74-487b-976a-f8a512d693e0
&response_type=code
&redirect_uri=https://jwt.ms
&response_mode=query
&scope=https://graph.microsoft.com/.default
&state=12345

I generated access token by using below parameters:

https://login.microsoftonline.com/TenantID/oauth2/v2.0/token

client_id:ClientID
grant_type:authorization_code
scope:https://graph.microsoft.com/.default
code:code
redirect_uri:https://jwt.ms
client_secret:ClientSecret

When I decoded the token, the scope is displayed like below:

For sample, by using the above generated access token I called the Graph API like below:

https://graph.microsoft.com/v1.0/users 

Hence, if you are exposing an API and adding the scope it will be delegated. You must make use of User Interaction Flows.

If you want to generate access token on behalf of user then create App Roles and generate token via Client Credential flow.

First of all, you had grant_type:client_credentials so you are using client credential flow. This flow means the access token would be generated on behalf of the application itself so it doesn't require a user to sign in, and the api permission should be Application type. And Kiron's answer is out of date because what he showed you used V1.0 flow so you have resource:Required URL, but we are now using V2.0 flow which request parameter should be scope: xxxx/.default for client credential flow.

So first you should follow this section to expose an API. We need to create a role instead of add a scope. Then you can go to add API permission, going to the Azure AD app -> API permission blade -> add api permission -> choose My APIs -> the application you exposed API -> choose Application permissions -> you will see the role you created and add this API permission -> grant admin consent if you required. Then you can see like this which means the API already added and consented.

And if you click this api permission, you will see the scope url like api://client_id/role_name

Now, let's go to postman to send request like this, the scope must be ended with /.default. The app exposing API and the API you used to get authentication can be different, so the value of client_id and client_id_exposing_API can be different when you don't use the same APP.

Post: https://login.microsoftonline.com/tenantname.onmicrosoft.com/oauth2/v2.0/token 
Content-Type: application/x-www-form-urlencoded

client_id=xxxx
&scope=api://client_id_exposing_API/.default
&client_secret=sampleCredentia1s
&grant_type=client_credentials

We can decode the generated access token to check if it contained roles claim which containing the role you created.

When using this token but still failed to call your API, then it should be another story and you may need to share how you configure your API application.