How to configure Azure App Service Authentication for Microsoft Accounts to use arbitrary scopes (like office.onenote_update)

Question

Azure App Service Authentication works great when requesting scopes that exist in the UI (e.g. office.onenote_create). However, I need scopes (e.g. office.onenote_update) that aren't listed in the UI. How can I add those scopes?

Answer 1

That’s old UX. That scope can still be requested from the client call. All that these checkboxes provide is the ability to inject on the backend request.

Another option is to use something like https://resources.azure.com to manually add the desired scope to the backend config.

https://resources.azure.com/subscriptions/SUBID/resourceGroups/RGNAME/providers/Microsoft.Web/sites/SITENAME/config/authsettings/list

"microsoftAccountOAuthScopes": [
  "wl.signin",
  "wl.birthday",
  "wl.calendars_update",
  "wl.contacts_birthday"
]