title: Postman Client Credentials Flow with Azure AD protected ressource
body: <p>I am currently using this example:</p>
  
  <p><a href="https://docs.microsoft.com/en-us/azure/active-directory/active-directory-authentication-scenarios#daemon-or-server-application-to-web-api" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/active-directory/active-directory-authentication-scenarios#daemon-or-server-application-to-web-api</a></p>
  
  <p>To check the Client Credentials Flow with OAuth in Azure AD. Theoretically the example works OK. Client App successfully communicates with the server App, obtaining first the OAuth Token from Azure AD token url. No problems there. However, I am trying to use Postman to check the Client Credentials Flow and I cannot get it to work. </p>
  
  <p>In Postman, I should provide an <strong>Access Token Url</strong>, a <strong>Client ID</strong> and a <strong>Client Secret</strong>, <strong>Grant Type</strong> is set to <strong>Client Credentials</strong>. Using the same parameters as in the example provided by Microsoft's sample in <a href="https://github.com/Azure-Samples/active-directory-dotnet-daemon" rel="nofollow noreferrer">https://github.com/Azure-Samples/active-directory-dotnet-daemon</a>, I get a <strong>401</strong> response when trying to access the web service. I think the main reason is because in Postman, I can not type the <strong>resource</strong> I want to access, so the received token is not "linked" to any resource and that is why the authorization fails in the web server? Could this be the reason? If that is the reason, then what should I do in the server, because, somehow it seems as if Postman's requirements should be the ones valid in the Client Credentials Flow (I mean, no <strong>resource</strong> should be given, according to the OAuth2 Client Credentials Flow, right?</p>
  
  <p>This is the code for the Starup class in the sample downloaded from Microsoft's example</p>
  
  <pre><code>    // For more information on configuring authentication, please visit http://go.microsoft.com/fwlink/?LinkId=301864
      public void ConfigureAuth(IAppBuilder app)
      {
          app.UseWindowsAzureActiveDirectoryBearerAuthentication(
              new WindowsAzureActiveDirectoryBearerAuthenticationOptions
              {
                  Audience = ConfigurationManager.AppSettings["ida:Audience"],
                  Tenant = ConfigurationManager.AppSettings["ida:Tenant"]
              });
      }
  </code></pre>
  
  <p><strong>ConfigurationManager.AppSettings["ida:Tenant"]</strong> is my Azure AD tentant, while 
  <strong>ConfigurationManager.AppSettings["ida:Audience"]</strong> is the protected resource I need to access. Both values are required, if I do not provide the Audience, I get an error in .NET web API initialization.</p>