Get OAuth 2.0 Token from personnal accounts (Outlook)

Viewed 92

I am trying to use @azure/msal-node on a node backend server.  all work fine for business accounts onmicrosoft.com but not for personnal accounts like outlook.com

according to this documentation, Authentication seems to be possible https://docs.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth

But i don't understand if my problem come from azure AD configuration or from my code. 

exp.post('/connect', function (req, res) {
  let authCodeUrlParameters = {
    scopes: SCOPES_OUTLOOK,
    redirectUri: "http://localhost:4220/redirect",
  };
  publicMicrosoftClient.getAuthCodeUrl(authCodeUrlParameters).then((response) => {
    if (req.body.email) {
      response += `&login_hint=${req.body.email}`
    }
    open(response)
  }).catch((error) => console.log(JSON.stringify(error)));
});

exp.get('/redirect', async function (req, res) {
  try {
    const form = {
      'code': req.query.code,
      'client_id': CLIENT_ID_OUTLOOK,
      'scope': SCOPES_OUTLOOK.join(' '),
      'redirect_uri': 'http://localhost:4220/redirect',
      'grant_type': 'authorization_code',
      'client_secret': encodeURI(SECRET_VALUE_OUTLOOK),
    }

    const options = {
      url: 'https://login.microsoftonline.com/common/oauth2/v2.0/token',
      headers: {
        'Content-Type': 'application/x-www-form-urlencoded',
      },
      method: 'post',
    }

    response = await got(options, { form });
    respToken = response.body
    ...
  } catch (error) {
    console.log(error)
    res.end();
  }
});

the error come from ...v2.0/token request. the server response doesn't really help (error 400 bad request)

in azure AD we have app registered and all required scope with status granted. Thank you in advance for your help, Yan

1 Answers

• You are getting this error because you have not allowed or selected ‘Accounts in any organizational directory (Any Azure AD directory - Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox)’ as shown below in the snapshot for the Azure AD app registered regarding authentication for your backend code: -

Personal accounts - Azure AD

• Also, if you have already configured your Azure AD application registration for your node backend code, then you can also configure the above in your Azure AD app’s ‘Application Manifest’ by modifying the parameter ‘signInAudience’ with the value as ‘AzureADandPersonalMicrosoftAccount’ as well as ensure that the below parameters are also set as per the stated values to resolve this issue: -

  “allowPublicClient” : true
  “accesstokenAcceptedVersion” : 2

Azure AD App manifest

Azure AD App manifest - 2

For more information regarding this, kindly refer to the below link: -

https://docs.microsoft.com/en-us/azure/active-directory/develop/reference-app-manifest

Related