title: Using Azure Service Management REST API as a registered Active Directory app
body: <p>We have an application that talks to Azure Service Management API (management.azure.com) to automatically upload API definitions in API Management.</p>
  
  <p>As authentication method, we created an "App Registration" in Azure Active Directory, and assigned a secret. So we use the client ID and secret of this application. This method is described here:</p>
  
  <p><a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/scenario-daemon-overview" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/active-directory/develop/scenario-daemon-overview</a></p>
  
  <p>The token is retrieved using MSAL:</p>
  
  <pre><code>private static async Task&lt;string&gt; GetAccesToken(AzureADApplicationCredentials adApplicationCredentials)
  {
      var scopes = new string[] { @"https://management.azure.com/.default" };
  
      var app = Microsoft.Identity.Client.ConfidentialClientApplicationBuilder
         .Create(adApplicationCredentials.ClientId)
         .WithClientSecret(adApplicationCredentials.Secret)
         .WithAuthority(new Uri($"https://login.microsoftonline.com/{adApplicationCredentials.DirectoryId}"))
         .Build();
  
      var result = await app.AcquireTokenForClient(scopes).ExecuteAsync();
  
      return result?.AccessToken;
  }
  </code></pre>
  
  <p>Using this authentication, we can successfully get a list of API's, but the call to add an api to a service fails with the following error:</p>
  
  <pre><code>{
      "error": {
          "code": "AuthorizationFailed",
          "message": "The client 'f42...' with object id 'f42...' does not have authorization to perform action 'Microsoft.ApiManagement/service/apis/write' over scope '/subscriptions/27e.../resourceGroups/OurResouceName/providers/Microsoft.ApiManagement/service/OurServiceName/apis/7c6...' or the scope is invalid. If access was recently granted, please refresh your credentials."
      }
  }
  </code></pre>
  
  <p>What i have tried:</p>
  
  <ul>
  <li>I have noticed that i can assign permissions in the "API Permissions" section of the App registration, but i am only able to assign the "user_impersonation" permission for "Azure Service Management", which i dont think is actually needed in my scenario.</li>
  <li>I am using the <a href="https://management.azure.com/.default" rel="nofollow noreferrer">https://management.azure.com/.default</a> scope, as suggested by the documentation. I think i should be able to pass in a different scope than .default, but i cannot find any further information on this.
  I did encounter this page, which lists all the permissions:
  <a href="https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftapimanagement" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftapimanagement</a>
  I have tried using there values as scopes (Microsoft.ApiManagement/service/apis/write etc ...) to no avail.</li>
  </ul>
  
  <p>Any thoughts on how i can make this work?</p>