Azure AD B2C授权代码流-访问graph.windows.net

Question

I use Azure AD B2C authorization code flow (below I inserted line breaks in URLs and form contents for better visibility).

First I'm opening following URL in browser:

https://mycompany.b2clogin.com/mycompany.onmicrosoft.com/oauth2/v2.0/authorize?
client_id=8acddeb9-e950-4d64-802c-dcc9fab4f89b&
response_type=code&
redirect_uri=https%3A%2F%2Fmy-company-site.com%2F&
response_mode=query&
scope=8acddeb9-e950-4d64-802c-dcc9fab4f89b%20offline_access%20openid&
state=arbitrary_data_you_can_receive_in_the_response&
p=B2C_susi_test

After entering credentials I'm getting redirected to

https://my-company-site.com/?
state=arbitrary_data_you_can_receive_in_the_response&
code=__authorization_code__

After that I'm trying to request the access_token (here it's for https://graph.windows.net/ ):

POST https://mycompany.b2clogin.com/mycompany.onmicrosoft.com/oauth2/v2.0/token?p=B2C_susi_test
User-Agent: Fiddler
Host: mycompany.b2clogin.com
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code&
client_id=8acddeb9-e950-4d64-802c-dcc9fab4f89b
scope=openid+offline_access&
code=__authorization_code__&
redirect_uri=https%3A%2F%2Fmy-company-site.com%2F&
client_secret=__client_secret__&
resource=https%3A%2F%2Fgraph.windows.net%2F

As a result I'm getting following JSON:

{
    "id_token": "__a_token__",
    "token_type": "Bearer",
    "not_before": 1564662310,
    "id_token_expires_in": 3600,
    "profile_info": "__some_info__",
    "refresh_token": "__refresh_token___",
    "refresh_token_expires_in": 1209600
}

First of all, access_token is missing here, but there is id_token , which differs from docs .

Then I tried to use id_token for accessing https://graph.windows.net :

GET https://graph.windows.net/mycompany/users/me?api-version=1.6 HTTP/1.1
User-Agent: Fiddler
Host: graph.windows.net
Authorization: Bearer __a_token__

The response (401):

{
    "odata.error": {
        "code": "Authentication_ExpiredToken",
        "message": {
            "lang": "en",
            "value": "Your access token has expired. Please renew it before submitting the request."
        }
    }
}

Any ideas why the token is access_token is missing or how to use id_token ?

Answer 1

You cannot access any Microsoft First Party services using a an AAD B2C application registration and B2C User Journey.

If you need access to a Microsoft service, use AAD App registrations and AAD flows.

In a B2C scenario, where the web server needs access to Graph API, have the web server use client credentials flow against an AAD App Registration within the B2C directory.

Answer 2

You can't acquire an access token for the Azure AD Graph API -- since this API isn't an Azure AD B2C-registered application -- using an Azure AD B2C flow.

You must acquire it using an Azure AD flow .