[Bug] ExtraScopesToConsent is not working as expected for accounts outside of the home tenant

Which Version of MSAL are you using ? MSAL 4.1.0

Platform netcore console app, possibly existent on android too

What authentication flow has the issue?

• Desktop / Mobile
  • Interactive
  • Integrated Windows Auth
  • Username Password
  • Device code flow (browserless)
• Web App
  • Authorization code
  • OBO
• Web API
  • OBO

Is this a new or existing app? This is a new app or experiment

Repro Register two applications in Azure portal - Client and Server. In Client add http://localhost as a redirect uri for public client (to enable .net core os browser). In server expose an api with the format api://server_application_id/user_impersonation.

var pca = PublicClientApplicationBuilder.Create("<client application id>")
    .WithDefaultRedirectUri()
    .Build();

await pca.AcquireTokenInteractive(new[] { "User.Read", "Files.Read" })
    .WithExtraScopesToConsent(new[] { "api://<server application id>/user_impersonation" })
    .WithSystemWebViewOptions(new SystemWebViewOptions { OpenBrowserAsync = SystemWebViewOptions.OpenWithEdgeBrowserAsync })
    .ExecuteAsync();

var accounts = await pca.GetAccountsAsync();
var account = accounts.FirstOrDefault();

await pca.AcquireTokenSilent(new[] { "User.Read", "Files.Read" }, account).ExecuteAsync();
await pca.AcquireTokenSilent(new[] { "api://<server application id>/user_impersonation" }, account).ExecuteAsync();

Expected behavior Both acquire token silent calls succeed.

Actual behavior On the second acquire call, i.e on trying to acquire a token for the server application it throws an error AADSTS70000: The request was denied because one or more scopes requested are unauthorized or expired. The user must first sign in and grant the client application access to the requested scope. Trace ID: a356c4c1-c5bc-4318-be7c-a806cdda1f01 Correlation ID: 8def64e5-98ab-4037-a223-6bf17cb7acab.

Possible Solution If the server api scope is passed directly in AcquireTokenInteractive instead of via ExtraScopesToConsent it works correctly. It should work always though I’m assuming.

[jmprieur]

Thanks for the update @ashikns My recommendation for the moment is to use the Web API for the scope. I’ll check with the service people what we can do.

[bgavrilMS]

THis has been fixed by AAD.