OpenId Connect Authentication & Azure AD Scopes Confusion

Question

I am trying to understand the correlation between the scopes I request in the Scope property of OpenIdConnectAuthenticationOptions and what is returned in my access token.

When I request only "openid profile" I get all the scopes that have been granted consent by the user or admin. Also the version of the access token returned seems to be dependent on the scopes request. For example if I include my registered "api://........". I believe I have both my web app and api configured in the manifest to version 2.

For example: "openid profile" returns the scopes "Directory.Read.All Group.Read.All User.Read profile openid email" in my access token.

Do certain scopes automatically map to others or is there some logic to this? For my own understanding I am trying to find some logical cause and effect to what's going on.

question from:https://stackoverflow.com/questions/66049996/openid-connect-authentication-azure-ad-scopes-confusion

Answer 1

When you only put "openid profile" in scope, the default scopes in access token "Directory.Read.All Group.Read.All User.Read profile openid email" is for Microsoft Graph API by default. It is by design.

Because this access token is used to call the UserInfo endpoint, wherein the user information is actually from Microsoft Graph.

When you put "api://........" in scope, the access token will be for your API application. There is an aud claim in the access token, which identifies the intended recipient of the token. You can check that.