OAuth2 Client Credentials flow for Microsoft Graph

Question

The OAuth2 specification for Client Credentials ( https://tools.ietf.org/html/rfc6749#section-4.4 ) says that "The authorization server MUST support the HTTP Basic authentication scheme for authenticating clients that were issued a client password" but MAY support including the client credentials in the body of the message.

I can see from the Microsoft Graph API documentation that they describe using this latter method.

However, does this mean that the Basic Authentication approach is NOT supported or just that the alternative approach is preferred?

Thanks.

Answer 1

Please see token_type in the response .

token_type Indicates the token type value. The only type that Microsoft identity platform supports is bearer .

For your question in the comment, if the access token has expired, it will show an 401 error.