Not able to access Microsoft Graph Api using OAuth Access token

Question

I am trying to access Microsoft Graph Api for my OneDrive Business account. I have created an app in Azure Directory. I am able to authenticate, I am getting an access token but when trying to use that access token and use this api https://graph.microsoft.com/v1.0/me. I am getting this error : "Access token validation failure. Invalid audience." I dont know if I am missing any permission to access Graph APi?

Answer 1

According to Resolve Microsoft Graph authorization errors - Microsoft Graph | Microsoft Docs

API services like Microsoft Graph check that the aud claim (audience) in the received access token matches the value it expects for itself, and if not, it results in a 403 Forbidden error. A common mistake that causes in this error is trying to use a token acquired for Azure AD Graph APIs, Outlook APIs, or SharePoint/OneDrive APIs to call Microsoft Graph (or vice versa). Ensure that the resource (or scope) your app is acquiring a token for matches the API that the app is calling.

As your error message says, your token audience is invalid ,you must have set wrong scope when requesting the token.Please check the aud claim as commented in https://jwt.ms . Try to set the scope to https://graph.microsoft.com/.default in authentication request and give delegated and application permissions under Microsoft apis> Microsoft graph and grant admin consent to the api. etc . The api call only supports delegated permissions, so you can't use the client credential flow to get the token. For the /me endpoint, the user needs to log in, so you need Use auth code flow to obtain an access token. Calling /me end point requires delegated permissions.

And calling one drive api from that also requires another additional permissions for different activity.

You can make use of Graph Explorerto see the permissions required and according grant admin consent for the same through explorer itself or through portal.

If still error remains , please change the accesstokenacceptedversion to 2 if it is null or 1 or vice versa. And try again.