OneDrive personal account unable to aquire offline_access scope

I am trying to acquire an offline access/refresh token pair on my web api server using the on behalf of flow https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-on-behalf-of-flow

I am acquiring the id token for the assertion on the client side and sending to the server. My flow works correctly for OneDrive for business account, but for personal OneDrive I get an error trying to get an access token.

const endpoint = 'https://login.microsoftonline.com/common/oauth2/v2.0/token';
{
  client_id            : config.msgraph.clientId,
  client_assertion_type: 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer',
  scope                : ['Files.Read.All', 'Files.ReadWrite.All', 'User.Read', 'offline_access'].join(' '),
  grant_type         : 'urn:ietf:params:oauth:grant-type:jwt-bearer',
  requested_token_use: 'on_behalf_of',
  client_assertion: CreateJWT()
};

{
  "error": "invalid_grant",
  "error_description": "AADSTS70000: The request was denied because one or more scopes requested are unauthorized or expired. The user must first sign in and grant the client application access to the requested scope.\\r\\nTrace ID: 38a5157b-23ee-4112-8833-18036d524a00\\r\\nCorrelation ID: 85e47fe8-8c8a-45ae-83c6-94d785af1ff8\\r\\nTimestamp: 2021-02-28 23:29:51Z",
  "error_codes": [70000],
  "timestamp": "2021-02-28 23:29:51Z",
  "trace_id": "38a5157b-23ee-4112-8833-18036d524a00",
  "correlation_id": "85e47fe8-8c8a-45ae-83c6-94d785af1ff8",
  "error_uri": "https://login.microsoftonline.com/error?code=70000",
  "suberror": "consent_required"
}

Is offline_access supported for OneDrive Personal? I haven’t found anything documented to suggest otherwise.

Library

• [ x ] msal@1.x.x or @azure/msal@1.x.x
• @azure/msal-browser@2.x.x
• @azure/msal-node@1.x.x
• @azure/msal-react@1.x.x
• @azure/msal-angular@0.x.x
• @azure/msal-angular@1.x.x
• @azure/msal-angular@2.x.x
• @azure/msal-angularjs@1.x.x

Framework

• Angular
• React
• Other

Description

Error Message

MSAL Configuration

// Provide configuration values here.
// For Azure B2C issues, please include your policies.

Reproduction steps

// Provide relevant code snippets here.
// For Azure B2C issues, please include your policies.

Expected behavior

Identity Provider

• Azure AD
• Azure B2C Basic Policy
• Azure B2C Custom Policy
• ADFS
• Other

Browsers/Environment

• Chrome
• Firefox
• Edge
• Safari
• IE
• Other (Please add browser name here)

Regression

• Did this behavior work before? Version:

Security

• Is this issue security related?

Source

• Internal (Microsoft)
• Customer request

[arsnyder16]

I tracked down the issue within the onedrive picker there is code that is prepending https://graph.microsoft.com/ to any scope passed, but https://graph.microsoft.com/offline_access is an invalid scope.

I notice that the picker automatically passes profile, openid. I would be nice if this were to also pass offline_access or not prepend graph.microsoft.com

case c.default.AADv2: t = (i = “profile openid https://graph.microsoft.com/User.Read " + (r = e).scopes.map(function(e) { return “https://graph.microsoft.com/” + e }).join(” "),

[arsnyder16]

just some more information related.

I manually modified the OneDrive.js file and added offline_access beside profile openid and everything worked as expected.

One other odd behavior i notice with this library is i can’t just use my scopes that i use for msal

['profile', 'openid', 'offline_access', 'Files.Read.All', 'Files.ReadWrite.All', 'People.Read', 'Contacts.Read', 'User.ReadBasic.All']

The library is expecting to append All to Files.Read and Files.ReadWrite so i have to actually pass `‘Files.Read’, Files.ReadWrite’ instead

scopes: msal.scopes.map(scope => scope === 'Files.Read.All' || scope === 'Files.ReadWrite.All' ? scope.replace('.All', '') : scope)