I have a registered Azure app that is working in Microsoft production API. I've created a sandbox test account (according to this instruction) and I'm trying to receive an OAuth token. According to the instruction I've changed the login endpoint and result link is
https://login.windows-ppe.net/consumers/oauth2/v2.0/authorize?client_id=4abdfe32-XXXX-XXXX-XXXX-510dd884cd81&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%2Fmyapp%2F&response_mode=query&scope=openid%20offline_access%20https%3A%2F%2Fads.microsoft.com%2Fmsads.manage&state=12345
The problem is when I'm opening this link and trying to login with the created Sandbox account (xxxxxxxxxxxxx@outlook-int.com) it shows me unauthorized_client
error:
We're unable to complete your request
unauthorized_client: The client does not exist or is not enabled for consumers. If you are the application developer, configure a new application through the App Registrations in the Azure Portal at https://go.microsoft.com/fwlink/?linkid=2083908.
Supported account type for this application is any Azure AD and personal.
Any ideas what is wrong or what I've missed in my connection with Sanbox account (this happens with Sandbox account only)?
Initially, I too got same error when I used registered application Client ID and ran below login endpoint in browser:
https://login.windows-ppe.net/consumers/oauth2/v2.0/authorize?client_id=0f949c66-6790-xxxxxxxxxxx&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%2Fmyapp%2F&response_mode=query&scope=openid%20offline_access%20https%3A%2F%2Fads.microsoft.com%2Fmsads.manage&state=12345
As mentioned in this MS Document,
To authenticate in the sandbox environment you don't need to register an application. Just use the public "Tutorial Sample App" client ID i.e., 4c0b021c-00c3-4508-838f-d3127e8167ff.
To resolve the error, make use of below login endpoint by replacing ClientID and redirect URI values to authenticate with sandbox account like this:
https://login.windows-ppe.net/consumers/oauth2/v2.0/authorize?client_id=4c0b021c-00c3-4508-838f-d3127e8167ff&response_type=code&redirect_uri=https://login.windows-ppe.net/common/oauth2/nativeclient&response_mode=query&scope=openid%20profile%20https://api.ads.microsoft.com/msads.manage%20offline_access&state=12345
When I logged in with sandbox test account, I got consent screen with permissions:
After accepting the above consent, I got code
value in address bar successfully like this: