Forum Discussion

Frank_Lehmann's avatar
Frank_Lehmann
Copper Contributor
Mar 03, 2025

Error getting new token

Hi, i want to add a new member to a private channel.

I follow the authentication flow as follows:

a) starting with url

https://login.microsoftonline.com/#tenantid#/oauth2/v2.0/authorize?client_id=#clientid#&response_type=code&response_mode=query&redirect_uri=https://www.dashandwerk.net/dashandwerk/api/graph/webhook&scope=offline_access%20TeamMember.ReadWrite.All%20ChannelMember.ReadWrite.All%20User.Read&state=1234"

 

b) my redirect_uri will open and i am getting a new code

c) this new code will be used to get a new token with this url

https://login.microsoftonline.com/#tenant#/oauth2/v2.0/token?client_id=#client_id#

&client_secret=#client_secret#

&scope=offline_access%20TeamMember.ReadWrite.All,ChannelMessage.Send%20User.Read%20Mail.Read%20ChannelMember.ReadWrite.All'

&code=#code#

&redirect_uri=https://www.dashandwerk.net/dashandwerk/api/graph/webhook

&grant_type=authorization_code

 

But when getting the new token, i am getting this error:

"{"error":"invalid_grant","error_description":"AADSTS65001: The user or administrator has not consented to use the application with ID '640a5194-77b1-40cf-b774-fc9eb9a6d128' named 'dashandwerk-teams'. Send an interactive authorization request for this user and resource. Trace ID: 34a8ea64-b664-448c-9b7c-b4c9a92e0300 Correlation ID: 77e80082-9e58-4da9-8752-2d7bc75d7262 Timestamp: 2025-03-03 11:11:08Z","error_codes":[65001],"timestamp":"2025-03-03 11:11:08Z","trace_id":"34a8ea64-b664-448c-9b7c-b4c9a92e0300","correlation_id":"77e80082-9e58-4da9-8752-2d7bc75d7262","suberror":"consent_required"}

Searching on google shows this:
Make sure you have followed the steps to grant admin consent. You can do this under Application > API permissions > Grant admin consent.

 

But all grants have admin consent in the office admin center for intra at the app registration.

 

Any ideas to solve this issue ?

api
App
developer
Office Graph
  • RalfLueders's avatar
    RalfLueders
    Copper Contributor
    Mar 06, 2025

    Hallo Frank!

    I'm using powershell to access Graph.

    I assigned only application permissions to the Entra registered App (not delegated permissions!)
    So when connecting to Graph, no scope is needed:

     Connect Microsoft Graph
    $body = @{
        grant_type    = "client_credentials"
        scope         = "https://graph.microsoft.com/.default"
        client_id     = $clientId
        client_secret = $clientSecret
    }

    $response = Invoke-RestMethod -Uri "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token" -Method Post -Body $body
    $mgAccessToken = $response.access_token
    $mgSecureAccessToken = ConvertTo-SecureString $mgaccessToken -AsPlainText -Force
    $mg = Connect-MgGraph -AccessToken $mgSecureAccessToken



Resources