How to access azure devops apis via an azure app?

I am trying to get the jwt access token to call some azure devops API endpoints.

I first Get the code via oauth endpoint:
> https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=CLIENT_ID&response_type=code&prompt=select_account&scope=CLIENT_ID/.default&redirect_uri=https://foo.bar.com/auth

CLIENT_ID/.default ==
user_impersonation and
User.Read

this returns me a code

I then use this code to make a post request to:

> https://login.microsoftonline.com/organizations/oauth2/v2.0/token

with

grant_type:authorization_code
client_id:CLIENT_ID
client_secret:SECRET
scope:CLIENT_ID/.default
redirect_uri:https://foo.bar.com/auth
code:CODE

this returns me an access_token. However this access token doesn't seem to be able to do much.

I have tried it with https://graph.microsoft.com/v2.0/me/ (It always returns Access token validation failure. Invalid audience.) and https://dev.azure.com/paradime-io/_apis/git/repositories?api-version=2.0 (just html for me to login) - both using Authorization: Bearer {access_token} header but they do not work.

I have also tried to use it with git clone... username & password but that is also not working.

I have also tried to use on_behalf_of and the /token endpoint:

grant_type:urn:ietf:params:oauth:grant-type:jwt-bearer
client_id:CLIENT_ID
client_secret:SECRET
scope:CLIENT_ID/.default
//client_assertion_type:urn:ietf:params:oauth:client-assertion-type:jwt-beare
requested_token_use:on_behalf_of
assertion:CODE

but the returned access_token is also not useable on the other API endpoints.

To access Azure DevOps APIs via Azure AD application, you need to generate jwt access token with 499b84ac-1321-427f-aa17-267ca6975798/.default scope.

I registered one Azure AD application and added API permissions like below:

To get authorization code, I ran below authorization request in browser before acquiring token:

https://login.microsoftonline.com/<tenantID>/oauth2/v2.0/authorize
?client_id=<appID>
&response_type=code
&redirect_uri=https://jwt.ms
&response_mode=query
&scope=499b84ac-1321-427f-aa17-267ca6975798/.default
&state=12345

When I ran above request in browser, I got code value successfully in address bar like this:

I generated access token using authorization code flow successfully via Postman by including above code in below request:

POST https://login.microsoftonline.com/<tenantID>/oauth2/v2.0/token
grant_type:authorization_code
client_id: <appID>
client_secret: <secret>
scope: 499b84ac-1321-427f-aa17-267ca6975798/.default
code: <paste_code_from_above_request>
redirect_uri: https://jwt.ms

Response:

When I used above access token to call following DevOps API, I got response successfully like below:

GET https://dev.azure.com/<orgname>/_apis/git/repositories?api-version=2.0

Response:

To call Microsoft Graph, you need to change the scope value to https://graph.microsoft.com/.default while acquiring access token.