title: Unable to get bearer token from Azure AD to use with API App
body: <p>I have an MVC application that needs to access private API App in Azure that is protected with Azure AD authentication. So I need to get Azure AD bearer token, transfer it into <code>Zumo-Auth</code> token and use it to access the API App.  </p>
  
  <p>I'm going through <a href="https://azure.microsoft.com/en-us/documentation/articles/app-service-api-authentication-client-flow/" rel="nofollow noreferrer">this tutorial</a> and everything is working fine until the point when I need to request the token from <code>authContext</code>. Here is the snippet of a code:</p>
  
  <pre><code>var authContext = new AuthenticationContext(
      "https://login.microsoftonline.com/MyADDomain.onmicrosoft.com");
  
  ClientCredential credential = new ClientCredential(
      "04472E33-2638-FAKE-GUID-F826AF4928DB", 
      "OMYAPIKEY1x3BLAHEMMEHEHEHEHEeYSOMETHINGRc=");
  
  // Get the AAD token.
  var appIdUri = 
      "https://MyAppGateway-814485545465FAKE4d5a4532cd.azurewebsites.net/login/aad";
  
  //var appIdUri = "https://MyADDomain.onmicrosoft.com/MyAppName";
  //var appIdUri = "https://MyADDomain.onmicrosoft.com/";
  //var appIdUri = "https://graph.windows.net";
  
  AuthenticationResult result = 
      authContext.AcquireToken(appIdUri, credential); // &lt;-- can't get the token from AD
  
  // downhill from here
  var aadToken = new JObject();
  aadToken["access_token"] = result.AccessToken;
  var appServiceClient = new AppServiceClient(
      "https://MyAppGateway-814485545465FAKE4d5a4532cd.azurewebsites.net/");
  
  // Send the AAD token to the gateway and get a Zumo token
  var appServiceUser = await appServiceClient.LoginAsync("aad", aadToken);
  </code></pre>
  
  <p>The line with <code>authContext.AcquireToken(appIdUri, credential)</code> is the one causing trouble. </p>
  
  <p>If as <code>appIdUri</code> I give <code>https://MyAppGateway-814485545465FAKE4d5a4532cd.azurewebsites.net/login/aad</code>, I get exception: </p>
  
  <blockquote>
    <p>400: AdalServiceException: AADSTS50001: Resource '<a href="https://MyAppGateway-814485545465FAKE4d5a4532cd.azurewebsites.net/login/aad" rel="nofollow noreferrer">https://MyAppGateway-814485545465FAKE4d5a4532cd.azurewebsites.net/login/aad</a>' is not registered for the account. </p>
  </blockquote>
  
  <p>But this exact line is in the list of <code>Reply Url</code> in the AD Application</p>
  
  <p><a href="https://i.stack.imgur.com/hciWI.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/hciWI.png" alt="Reply URI in Azure AD Application"></a></p>
  
  <p>When I try to use <code>https://MyADDomain.onmicrosoft.com/MyAppName</code> or <code>https://MyADDomain.onmicrosoft.com/</code> as <code>appIdUri</code> I get a different exception message: </p>
  
  <blockquote>
    <p>400: AdalServiceException: AADSTS50105: Application '04472E33-2638-FAKE-GUID-F826AF4928DB' is not assigned to a role for the application '<a href="https://MyADDomain.onmicrosoft.com/MyAppName" rel="nofollow noreferrer">https://MyADDomain.onmicrosoft.com/MyAppName</a>'</p>
  </blockquote>
  
  <p>Or </p>
  
  <blockquote>
    <p>400: AdalServiceException: AADSTS50105: Application '04472E33-2638-FAKE-GUID-F826AF4928DB' is not assigned to a role for the application '<a href="https://MyADDomain.onmicrosoft.com/" rel="nofollow noreferrer">https://MyADDomain.onmicrosoft.com/</a>'</p>
  </blockquote>
  
  <p>In both cases I had the <code>App ID URI</code> in the AD Application set to '<a href="https://MyADDomain.onmicrosoft.com/MyAppName" rel="nofollow noreferrer">https://MyADDomain.onmicrosoft.com/MyAppName</a>' or '<a href="https://MyADDomain.onmicrosoft.com/" rel="nofollow noreferrer">https://MyADDomain.onmicrosoft.com/</a>'. And both of the names in the list of <code>Reply URL</code>. </p>
  
  <p>Eventually after enough tries I have put <code>https://graph.windows.net</code> as <code>appIdUri</code> and got the bearer token back. But the token was given with expiry date in the past (about 1 minute in the past). So I could not do anything further with this. And got <code>401-Unauthenticated</code> when tried to use the token to login into API App.</p>
  
  <p>What am I missing?</p>