I have created and registered an Application in Azure AD, which has multiple API permissions configured, among them Azure DevOps, the only available permission, user_impersonation.
I have successfully obtained an OAuth2 token via the full code flow, with requested scope of https://app.vssps.visualstudio.com/user_impersonation.
The access token is JWT, and I have decoded it:
{ :tid "bd4570a0-5905-40fb-8ebe-58479aecbc71",
:rh "0.AS8AoHBFvQVZ-0COvlhHmuy8cb1hUgm2ml5JrS8cjDMq-ZsvAAc.",
:given_name "R",
:scp "user_impersonation",
:email "rl@protonmail.com",
:aud "https://app.vssps.visualstudio.com",
:sub "h4S-EF9-NYufBaSwlUueuOTJbVnzAtXSeWg7R0_4IwQ",
:iss "https://sts.windows.net/bd4570a0-5905-40fb-8ebe-58479aecbc71/",
:name "R L",
:idp "live.com",
:exp 1638456612,
:uti "iHKHjhyHUEGpz4FQ37swAQ",
:aio "AWQAm/8TAAAA5hRQi967V5w85GNwWSWaJOVjEBs+FTyoWMdjgUQm6qoQoxjNDu1AuAHJuC9cJhWKmu89zXj2z5vNFiytM+wfKuoGrKDDZNAJSXdbWuKau+lTNOyPaugymzVO6q7ODR8W",
:family_name "L",
:amr ["pwd" "mfa"],
:nbf 1638452281,
:oid "3e18766c-8a5f-49be-9dcf-2c9edf03f6b1",
:ipaddr "188.230.144.31",
:appid "095261bd-9ab6-495e-ad2f-1c8c332af99b",
:unique_name "live.com#rl@protonmail.com",
:wids ["62e90394-69f5-4237-9190-012177145e10" "b79fbf4d-3ef9-4689-8143-76b194e85509"],
:appidacr "1",
:acr "1",
:ver "1.0",
:puid "1003200178C49F6B",
:iat 1638452281,
:altsecid "1:live.com:0003BFFD3D75E35F"}
So far so good. The important part here is aud that is the intended target for token which is "https://app.vssps.visualstudio.com" which is Azure DevOps service/resource.
I try to use is as a bearer token when calling Azure DevOps service: e.g.
GET https://app.vssps.visualstudio.com/_apis/profile/profiles/me?api-version=6.1-preview.3
with header Authorization value Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1N...
, I always get back a redirect to https://app.vssps.visualstudio.com/_signin?realm=app.vssps.visualstudio.com....., as if I wasn't authenticated.
Is there some step I am missing here? I have successfully called this endpoint with other types of authentication.