B2C & PCA: Missing scopes in token

MSAL 4.35.1.0 MSAL.Desktop 4.8 or later Windows 10 Enterprise

Issue: Everything runs fine when getting the token but no scopes are in the token according to jwt.ms Note: “signInAudience”: “AzureADandPersonalMicrosoftAccount” is on for everything.

Am I doing something wrong?

MSAL Info True True MSAL 4.35.1.0 MSAL.Desktop 4.8 or later Windows 10 Enterprise [22.69 - <logid>] 
=== Request Data ===
Authority Provided? - True
Client Id - <DesktopClientid>
Scopes - https://<B2CTenant>.onmicrosoft.com/<APIid>/read https://<B2CTenant>.onmicrosoft.com/<APIid>/write
Redirect Uri - msal<DesktopClientid>://auth
Extra Query Params Keys (space separated) - 
ClaimsAndClientCapabilities - 
Authority - https://<B2CTenant>.b2clogin.com/tfp/<B2CTenant>.onmicrosoft.com/B2C_1_SignUpOrIn/
ApiId - AcquireTokenInteractive
IsConfidentialClient - False
SendX5C - False
LoginHint - 
IsBrokerConfigured - False
HomeAccountId - 
CorrelationId - <logid>

MSAL Info True True MSAL 4.35.1.0 MSAL.Desktop 4.8 or later Windows 10 Enterprise [22.70 - <logid>] === Token Acquisition (InteractiveRequest) started:
	Authority: https://<B2CTenant>.b2clogin.com/tfp/<B2CTenant>.onmicrosoft.com/B2C_1_SignUpOrIn/
	Scope: https://<B2CTenant>.onmicrosoft.com/<APIid>/read https://<B2CTenant>.onmicrosoft.com/<APIid>/write
	ClientId: <DesktopClientid>
	
  [22.70 - <logid>] [Instance Discovery] Skipping Instance discovery for non-AAD authority. 
  [22.70 - <logid>] Using legacy embedded browser.
  [38.77 - <logid>] [Legacy WebView] Redirect URI was reached. Stopping WebView navigation...
  [38.79 - <logid>] An authorization code was retrieved from the /authorize endpoint. 
  [38.79 - <logid>] Exchanging the auth code for tokens. 
  [38.80 - <logid>] === InteractiveParameters Data ===
LoginHint provided: False
User provided: False
UseEmbeddedWebView: Embedded
ExtraScopesToConsent: 
Prompt: select_account
HasCustomWebUi: False

  [40.54 - <logid>] Checking client info returned from the server..
  [40.54 - <logid>] Saving token response to cache..
  [40.56 - <logid>] Subject not present in Id token. 
  [40.56 - <logid>] Saving AT in cache and removing overlapping ATs...
  [40.56 - <logid>] Looking for scopes for the authority in the cache which intersect with https://<B2CTenant>.onmicrosoft.com/<APIid>/read https://<B2CTenant>.onmicrosoft.com/<APIid>/write
  [40.56 - <logid>] Intersecting scope entries count - 0
  [40.56 - <logid>] Matching entries after filtering by user - 0
  [40.56 - <logid>] Saving Id Token and Account in cache ...
  [40.56 - <logid>] Saving RT in cache...
MSAL Info True True MSAL 4.35.1.0 MSAL.Desktop 4.8 or later Windows 10 Enterprise [40.57 - <logid>] Fetched access token from host <B2CTenant>.b2clogin.com. Endpoint https://<B2CTenant>.b2clogin.com/tfp/<B2CTenant>.onmicrosoft.com/b2c_1_signuporin/. 
  [40.57 - <logid>] 
	=== Token Acquisition finished successfully:
MSAL Info True True MSAL 4.35.1.0 MSAL.Desktop 4.8 or later Windows 10 Enterprise [40.57 - <logid>]  AT expiration time: 31/08/2021 1:55:40 AM +00:00, scopes https://<B2CTenant>.onmicrosoft.com/<APIid>/write https://<B2CTenant>.onmicrosoft.com/<APIid>/read source IdentityProvider from https://<B2CTenant>.b2clogin.com/tfp/<B2CTenant>.onmicrosoft.com/b2c_1_signuporin/ appHashCode 45562078

[RhomGit]

Nevermind, I found the problem. I was using the wrong property on AuthResult (idToken instead of AccessToken).

[bgavrilMS]

Can you give a few more details about what you are trying to do?

• you have a desktop app and you call AcquireTokenInteractive
• you ask for 2 scopes, which are scopes for your own web API?
• do the desktop app and the web api have the same client id?
• are the desktop app and the web api defined in a B2C tenant or is one of them an non-B2C tenant (il.e. AAD tenant)