When using MSAL to obtain a JWT, Android and iOS have different versions of the returned JWT.

이 현무 60

When authenticating with an MSAL to obtain a JWT, two different versions of the JWT are returned.

Both Android and iOS have the same endpoint, scope, and are looking at the same tenant's APP.

However, Android returns JWT v2, while iOS returns JWT v1.

Note that the scope is only “User.Read” and no Custom Scope is used.

If the problem is that Custom Scope is not used, I'm wondering why JWT v2 is returned on Android, and if there is a way to get JWT v2 on both without using custom scope.

Just to validate the token.

Navya 13,965 Reputation points Microsoft Vendor

2024-11-22T08:37:34.83+00:00

Hi @이 현무

Thank you for posting this in Microsoft Q&A.

I'm reviewing your query will get back to you shortly.

Thanks,

Navya.
이 현무 60 Reputation points

2024-12-02T01:31:25.68+00:00

Hello Navya, I would like to know the progress of the issue.
Navya 13,965 Reputation points Microsoft Vendor

2024-12-20T23:02:26.4733333+00:00

Hi @이 현무

Thank you for your patience while I looked into this.

I understand that the issue here is that two different versions of the JWT are being returned by MSAL when authenticating on Android and iOS, even though both platforms are using the same endpoint and scope and are looking at the same tenant's app.

To resolve this issue, you need to make sure that the accessTokenAcceptedVersion is set to 2 for the resource app (Web API) for which you are requesting the access token. You also need to specify your resource app (Web API) as the audience in the scope parameter while requesting the token (for example: scope=https://contosoApp.com/tasks.read), as shown below. However, if you use Microsoft web-hosted resources in the scope parameter such as Microsoft Graph (https://graph.microsoft.com) or Microsoft SharePoint (https://microsoft.sharepoint-df.com), then the v2.0 version token is not yet supported.

Could you please check the value of accessTokenAcceptedVersion in your application manifest file? A value of null or 1 result in v1.0 tokens, while a value of 2 results in v2.0 tokens. Also, make sure to use https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/authorize

For your reference: https://learn.microsoft.com/en-us/entra/identity-platform/access-tokens

Hope this helps. Do let us know if you any further queries.

Thanks,

Navya.
Navya 13,965 Reputation points Microsoft Vendor

2024-12-23T19:37:30.82+00:00

Hi @이 현무

Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.
이 현무 60 Reputation points

2024-12-24T06:11:54.3266667+00:00

Hi

Resolved by adding a custom scope. However, I don't understand why the token of v2 is returned in Android yet.
Navya 13,965 Reputation points Microsoft Vendor

2024-12-24T21:38:02.1566667+00:00

Hi @이 현무

Thank you for following up on this!

Can you confirm that 'custom scope' means scope=https://{appid}/tasks.read? Also, could you confirm that in the manifest, accessTokenAcceptedVersion is set to 2 for both Android and iOS? Additionally, could you share the token request endpoint for both applications?

Share via

When using MSAL to obtain a JWT, Android and iOS have different versions of the returned JWT.

Your answer