title: Microsoft graph return "access token is empty"
body: <p>I post this request:</p>
  
  <pre> <code>
  POST https://login.microsoftonline.com:443/{my-tennant-here}/oauth2/v2.0/token HTTP/1.1
  Host: login.microsoftonline.com 
  Content-Type: application/x-www-form-urlencoded
  
  client_id={client id here}
  &scope=https%3A%2F%2Fgraph.microsoft.com%2F.default
  &client_secret={client secret here}
  &grant_type=client_credentials
  </code> </pre>
  
  <p>This returns:</p>
  
  <pre> <code>
  {
    "token_type": "Bearer",
    "expires_in": 3599,
    "ext_expires_in": 0,
    "access_token": "eyJ0eX......
  }
  </code> </pre>
  
  <p>I have decoded the token using jwt.io and it definitely is not empty. It contains 14 claims. aud, iss, tid etc...</p>
  
  <p>I then use the access token in this request</p>
  
  <pre> <code>
  GET https://graph.microsoft.com/v1.0/users
  Athorization: Bearer eyJ0eX...
  </code> </pre>
  
  <p>I then get a 401 Unauthorized with this body:</p>
  
  <pre> <code>
  {
    "error": {
      "code": "InvalidAuthenticationToken",
      "message": "Access token is empty.",
      "innerError": {
        "request-id": "",
        "date": "2018-08-14T15:41:44"
      }
    }
  }
  </code> </pre>
  
  <p>Expected result was a 200 Ok with a body containing a list of users</p>
  
  <p>Does this simply mean that my app is Unauthorized, and the error message is just misleading (access token is empty)? 
  Or have I done something wrong?</p>
  
  <p>Update:
  I have noted that the although the token does contain claims it does not have a scope claim which seems a bit weird to me. I would assume that it had the User.Read.All scope. The application (client id/client secret) should have this permission.
  The claims in the token I receive have the following claims:
  <pre> <code>
  aud: "<a href="https://graph.microsoft.com" rel="nofollow noreferrer">https://graph.microsoft.com</a>",
  iss: "<a href="https://sts.windows.net/my" rel="nofollow noreferrer">https://sts.windows.net/my</a> tennant id",
  iat: timestamp
  nbf: timestamp
  exp: timestamp
  aio: looks like some kind of signature
  app_displayname: "the expected app name"
  appid: "the expected appid"
  appidacr: "1"
  idp: "<a href="https://sts.windows.net/" rel="nofollow noreferrer">https://sts.windows.net/</a>...."
  oid: "GUID"
  sub: "GUID"
  tid: "my tennant id"
  uti: "value"
  ver: 1.0 
  </pre></code></p>