Unable to call Microsoft Graph API with Auth0

G9000 5

Hi I'm following this document by Auth0
https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/azure-active-directory/v2

to establish a connection between Auth0 and Microsoft Azure Directory. From our understanding, we should be able to query Microsoft Graph API with our Auth0 Token provided that we configure it correctly. I can see that successful login on both Auth0 and Microsoft Application sign-in logs. But currently, we are getting the following error if I were to call graph API:

"code": "InvalidAuthenticationToken",

"message": "Signing key is invalid.",

"innerError": {

  "date": "2024-10-04T04:29:24",

  "request-id": "cb0a6894-3b78-4833-b330-1fa691846255",

  "client-request-id": "cb0a6894-3b78-4833-b330-1fa691846255"

}

スクリーンショット 2024-10-04 131645

スクリーンショット 2024-10-04 132102

スクリーンショット 2024-10-04 131632

1 answer

Yakun Huang-MSFT 4,800 Reputation points Microsoft Vendor

2024-10-04T07:23:11.9133333+00:00

Hello G9000,

Thank you for reaching out to Microsoft Support!

The error message for your key is invalid, please check your client ID, client secret is expired, is correct, as shown below:

Hope this helps.

If the answer is helpful, please click Accept Answer and kindly upvote it. If you have any further questions about this answer, please click Comment.
Please sign in to rate this answer.
G9000 5 Reputation points

2024-10-04T10:08:45.96+00:00

I just changed and updated it so it should not be expired. Also, the clientId is correct.

G9000 5 Reputation points

2024-10-08T09:12:37.98+00:00

Ok I got it working after extracting MS Token from Auth0 Management API. But now I encounter a new issue.

I can't call Calender at all. I got the following error

{ "error": { "code": "ErrorAccessDenied", "message": "Access is denied. Check credentials and try again." } }

I already add permission.

But then I realized my scope after decoding my token

"scp": "email openid profile User.Read",

The issue is I use Auth0 with an AD connection. I'm not sure the proper place to pass the scopes

Yakun Huang-MSFT 4,800 Reputation points Microsoft Vendor

2024-10-09T02:34:56.65+00:00

If you use Auth code flow, the permission you need to add should be the delegated permissions, add the delegate permission and get the token again.

Reference document:

https://learn.microsoft.com/en-us/graph/api/calendar-get?view=graph-rest-1.0&tabs=http

G9000 5 Reputation points

2024-10-09T07:54:13.43+00:00

I tried that previously but still same issue.

Yakun Huang-MSFT 4,800 Reputation points Microsoft Vendor

2024-10-09T10:11:15.0233333+00:00

After you add delegation permissions, re-parse the obtained tokens to check whether the scp in the parsed result has changed.

G9000 5 Reputation points

2024-10-11T06:55:37.2933333+00:00

Ok, it works, does it cache for existing users? I tried to log in thru Copilot, but it did not prompt me to allow access just a silent login. It works for new accounts tho.

Yakun Huang-MSFT 4,800 Reputation points Microsoft Vendor

2024-10-11T09:59:09.75+00:00

I'm glad it worked. Yeah, there's a cache, and when you log in, it's going to be cached and automatically logged in.

Please don’t forget to click "Accept Answer" which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Unable to call Microsoft Graph API with Auth0

1 answer

Your answer