How to get JWT from Microsoft Entra ID with an API scope when doing implicit flow?

Question

There is an App Registration in Azure where the client id is 00001111-aaaa-2222-bbbb-3333cccc4444 and a scope is api://3f4c1d35-3161-4c45-b5ec-ff7be4e89473/access_as_user and a redirect URI is https://jwt.ms. What would be the browser openable URL that redirects to https://jwt.ms and shows JWT with scope on it?

If one uses the Azure CLI, the commands would be something like

az login --scope api://3f4c1d35-3161-4c45-b5ec-ff7be4e89473/access_as_user
az account get-access-token --resource "api://3f4c1d35-3161-4c45-b5ec-ff7be4e89473" --scope "api://3f4c1d35-3161-4c45-b5ec-ff7be4e89473/access_as_user" --query accessToken

if one uses following URL

https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize?
client_id=00001111-aaaa-2222-bbbb-3333cccc4444
&response_type=id_token
&redirect_uri=https%3A%2F%2Fjwt.ms
&scope=openid%20api%3A%2F%2F3f4c1d35-3161-4c45-b5ec-ff7be4e89473%2Faccess_as_user
&response_mode=fragment
&state=12345
&nonce=678910

The scope is not included in JWT.

TylerH · Accepted Answer · 2025-07-16 19:17:02Z

1

Here is how to do this:

Register a Single-Tenant Microsoft Entra ID Application and add redirect_uri: https://jwt.ms:

Configure the authentication tab of application like below:

Add the Application ID URI and expose an API access_as_user like below:

Now add the access_as_user permission and grant Admin Consent:

Now, run the below request in the browser:

https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/authorize?
client_id=<application-id>
&response_type=token
&redirect_uri=https://jwt.ms
&scope=api://<application-id>/access_as_user
&response_mode=fragment
&state=12345
&nonce=678910

You should now successfully get scp in your JWT:

edited Jul 16 at 19:17

TylerH

21.3k84 gold badges84 silver badges121 bronze badges

answered Feb 27 at 18:59

Pratik Jadhav

1,2381 gold badge3 silver badges8 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

How to get JWT from Microsoft Entra ID with an API scope when doing implicit flow?

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related