The application xxx asked for scope Device.ReadWrite.All that doesn't exist on the resource xxx. Contact the vendor

user_11618256 0
Viewed 282

I am facing this error for a different permission Device.ReadWrite.All . I am trying to get an access token using authorization code grant workflow, but get this error. If I use client credentials grant workflow, I am able to receive the token.

The error is The application xxx asked for scope Device.ReadWrite.All that doesn't exist on the resource xxx. Contact the vendor

  1. Can anyone please explain why this happens
  2. Device.ReadWrite.All is application permission so can I only get token using client credentials grant workflow?
azure graph
1 Answers

Can anyone please explain why this happens

As you have said, Device.ReadWrite.All is application permission not a delegated permission.

When you use anesthetization code flow, a client application is granted permission to access a resource on behalf of a specific user. The permission is delegated from the user to the application, usually during the consent process.

However, in the client credentials flow, permissions are granted directly to the application itself. When the app presents a token to a resource, the resource enforces that the app itself has authorization to perform an action and not the user.

So, when you use authentization code flow(user interactive) to get code, it will get error message, you need to use service to service flow to get access token.

Device.ReadWrite.All is application permission so can I only get token using client credentials grant workflow?

Yes, only could use client credential to get application permission.

user_85579990
Related