title: Why doesn't my Azure Active Directory auth token contain permissions for MS Graph?
body: <p>I'm working in Postman before I start writing app code so that I can get my head around what I'm actually supposed to be doing - it's educational; in actual app dev, I'll be using MSAL for auth.</p>
  <p>In the meantime, I can't even manage to get a token that works.</p>
  <p>My app on Azure has the <code>Calendar.Read</code> and <code>Calendar.ReadWrite</code> permissions set in the API Permissions blade of the Azure Portal.</p>
  <p>I've created a client secret for the app (so using client credentials flow) and I'm providing the <code>/.default</code> scope per <a href="https://docs.microsoft.com/en-us/answers/questions/256281/microsoft-azure-ad-jwt-token-is-missing-scope-info.html" rel="nofollow noreferrer">this accepted answer on MS docs</a>.</p>
  <p>When I try to query MS graph at <code>https://graph.microsoft.com/v1.0/users/&lt;my user id&gt;/events</code> I get the error saying:</p>
  <blockquote>
  <p>The token contains no permissions, or permissions can not be understood</p>
  </blockquote>
  <p>Sure enough, the token contains neither the <code>scp</code> or <code>roles</code> claims.</p>
  <p>I've also referenced <a href="https://www.c-sharpcorner.com/article/getting-started-with-microsoft-graph-api/" rel="nofollow noreferrer">csharpcorner</a> to get a token as well as <a href="https://docs.microsoft.com/en-us/rest/api/servicebus/get-azure-active-directory-token" rel="nofollow noreferrer">the actual documentation</a> to configure the request in Postman.</p>
  <p>I don't understand where I'm going wrong. As far as I can tell I'm doing everything the way I'm supposed to be but I'm just not getting anywhere.</p>
  <p>Where am I going wrong? Have I missed something? Is there something I'm doing wrong?</p>
  <p>Here's my jquery code from Postman:</p>
  <pre><code>var settings = {
    &quot;url&quot;: &quot;https://login.microsoftonline.com/redacted/oauth2/token&quot;,
    &quot;method&quot;: &quot;POST&quot;,
    &quot;timeout&quot;: 0,
    &quot;headers&quot;: {
      &quot;Content-Type&quot;: &quot;application/x-www-form-urlencoded&quot;
    },
    &quot;data&quot;: {
      &quot;grant_type&quot;: &quot;client_credentials&quot;,
      &quot;client_id&quot;: &quot;redacted&quot;,
      &quot;client_secret&quot;: &quot;redacted&quot;,
      &quot;resource&quot;: &quot;https://graph.microsoft.com&quot;,
      &quot;scope&quot;: &quot;./default&quot;
    }
  };
  
  $.ajax(settings).done(function (response) {
    console.log(response);
  });
  </code></pre>
  <p>Your help is greatly appreciated.</p>
  <p>Thanks in advance</p>