title: Access Token for both Microsoft Graph and Custom API
body: <p>I have a ReactJs frontend making requests to an API. Both hosted in Azure with app registrations in AAD as well. </p>
  
  <p>I used to be able to use v1.0 auth endpoint, and create a valid token for the API:</p>
  
  <pre><code>https://login.microsoftonline.com/common/oauth2/authorize?client_id=&lt;AAD_WEB_APP_ID&gt;&amp;resource=&lt;AAD_API_ID&gt;&amp;response_type=token ...
  </code></pre>
  
  <p>If I understand <a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/azure-ad-endpoint-comparison#limitations" rel="nofollow noreferrer">the documentation</a> correctly, this type of auth flow isn't allowed/possible in v2.0:</p>
  
  <blockquote>
    <p>However, that Web API can receive tokens only from an application that has the same Application ID. You cannot access a Web API from a client that has a different Application ID. The client won't be able to request or obtain permissions to your Web API.</p>
  </blockquote>
  
  <p>The reason for changing from v1.0 to v2.0 is that I need access to Microsoft Graph (<em>Groups</em> in particular).</p>
  
  <p>My question is: How can I create an <code>access_token</code> that works for Microsoft Graph and my API? If that isn't possible, what would the correct auth flow be?</p>