.netazureazure-active-directoryazure-api-apps

Azure AD issuing token that contains scopes I disabled

I'm trying to use Azure AD to restrict access to certain endpoints in my API.

I registered a FrontEnd and API app in Azure AD. When I go to disable the scopes I'm still getting the scopes issued in my oauth token.

FrontEnd-Scope

Oauth-token

Anyone have any ideas what I may be missing?

Solution

  • You may forget to reconsent for these permissions.

    AAD v1 endpoint acts static permissions consent. Once you do permissions consent, the scope will be static, except you reconsent for new permissions. If you change the permissions and don't reconsent, the scope should be just as same as before.

    So, you can just click Grant permissions button to reconsent permissions. Or you can just add &prompt=admin_consent in the request to force doing consent.