title: "The access grant authorization_code is not supported" from Azure AD using Oauth 2
body: <p>I am in the middle of an  <a href="http://msdn.microsoft.com/en-us/library/azure/dn645542.aspx" rel="nofollow">Authorization Code Grant Flow</a> with Azure AD.  Even though the documentation says the <code>grant_type</code> should be <code>authorization_code</code>, I am getting an error message about this property.</p>
  
  <pre><code>POST https://login.windows.net/SOME_AZURE_AD_UUID/oauth2/token?api-version=1.0
  Content-Type: application/x-www-form-urlencoded
  
  client_id=SECRET_CLIENT_ID
  &amp;client_secret=SECRET_CLIENT_SECRET
  &amp;code=SECRET_CODE
  &amp;grant_type=authorization_code
  &amp;redirect_uri=https://myserver.example.com/login/auth_return
  &amp;resource=https://myserver.example.com/
  &amp;scope=openid email
  </code></pre>
  
  <p><em>(<strong>edit</strong>: whitespace added for clarity)</em></p>
  
  <p>The error I am getting back:</p>
  
  <pre><code>HTTP/1.1 400 Bad request
  Content-Length: 436
  X-Content-Type-Options: nosniff
  X-Powered-By: ASP.NET
  Request-Id: SOME_REQUEST_ID
  X-Ms-Request-Id: SOME_REQUEST_ID
  Strict-Transport-Security: max-age=31536000; includeSubDomains
  Set-Cookie: x-ms-gateway-slice=slicea; path=/; secure; HttpOnly, stsservicecookie=acs; path=/; secure; HttpOnly
  Server: Microsoft-IIS/8.0
  Cache-Control: private
  Date: Wed, 20 Aug 2014 14:44:08 GMT
  Content-Type: application/json; charset=utf-8
  
  {
    "correlation_id": "SOME_CORRELATION_ID",
    "error": "unsupported_grant_type",
    "error_codes": [
      70003
    ],
    "error_description": "
      ACS70003: The access grant 'authorization_code' is not supported.\r\n
      Trace ID: SOME_TRACE_UUID\r\n
      Correlation ID: SOME_CORRELATION_ID\r\n
      Timestamp: 2014-08-20 14:44:08Z",
    "timestamp": "2014-08-20 14:44:08Z",
    "trace_id": "SOME_TRACE_UUID"
  }
  </code></pre>
  
  <p><em>(whitespace added for clarity)</em></p>
  
  <p>This request does work if I change <code>grant_type</code> to <code>client_credentials</code> (but I have not found a way to use the resulting token for what I need).  It also works if I change some URLs to point to Google instead of Azure AD.</p>
  
  <p>Is there a mistake with these requests or does the service genuinely not support the documented <code>grant_type</code> of <code>authorization_code</code>?</p>