Unable to request Access Token via refresh_token grant type

Question

Hi,

I have a SPA and backend applications that both have app registrations in Entra.

For the SPA app registration I have granted Admin Consent for the Microsoft Graph permissions email, openid, profile, offline_access and User.Read as well as the backend app registration's role (api://<app_id>/Default).

The configuration under Enterprise Applications -> Consent and permissions -> User consent settings is 'Do not allow user consent' and users cannot request admin consent to apps they are unable to consent to​. This is due to org wide policy.

The SPA as part of user login first makes a request to get an access token via the OAuth authorization_code flow and this succeeds.

However when it tries to use the refresh token supplied from the last request to obtain a further token we get the response:

{"error": "invalid_grant",     
"error_description": "AADSTS65001: The user or administrator has not consented to use the application with ID '<app-id>' named '<appname>'. Send an interactive authorization request for this user and resource. ...",     
"error_codes": [ 65001 ]
}

We have tried changing all sorts of settings to do with consent or scopes but nothing changes this error.

One thing to note is if we replicate the config using a free trial of Entra with a different account then it works.

What organisation/tenant level settings are there that could cause the error above?

Answer 1

Refresh tokens leverage the offline_access permission, so make sure that has been granted on the app. If the tenant is blocking consent altogether, an admin will need to do this. Or they can "whitelist" the offline_access permission under User consent settings, so that end users can grant it to apps. This is in fact part of the default configuration, which is why your app works as expected in other tenants.

Answer 2

The problem was caused by a miss naming of the backend application scope in the token request

i.e. the scope was 'api://<app-id>/ScopeName' and the frontend app registration had been incorrectly configured to request a scope that didn't exist 'api://<app-id>/WrongScopeName'.

The reason we only saw the error for the refresh token was because the MSAL library that we were using for the SPA auth only adds the app scope in the refresh grant type request and not the initial token request.

Answer 3

Hello @jbf
I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to "Accept " the answer.

Issue: Unable to request Access Token via refresh_token grant type

Solution: Resolved by @jbf

"The problem was caused by a miss naming of the backend application scope in the token request"

The reason was you only saw the error for the refresh token was because the MSAL library that we were using for the SPA auth only adds the app scope in the refresh grant type request and not the initial token request.
If you have any other questions or are still running into more issues, please let me know. Thank you again for your time and patience throughout this issue.

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

Thanks,
B. Siri Chandana.