title: Azure AD: AcquireTokenAsync for a native app fails when appRoleAssignmentRequired = true
body: <p>We have a registered Web application in Azure AD that requires a valid Bearer OAuth token to proceed. Normally, the authentication flow comes from Javascript UI, the OAuth token is passed from middleware to the target Web API REST service application, it validates the token against <code>ValidAudiences</code>, and everything works great.</p>
  
  <p>Now, we have a non-user consumer: another service that would need access to this app. To do this, we created a new "Native" app in Azure AD with a key (secret) for authentication. The app has three API permissions: <code>Azure Active Directory</code>, <code>Windows Azure Service Management API</code> and the app to access. </p>
  
  <p>To acquire the authentication token for the new application, we use the following code:</p>
  
  <pre><code>private static async Task&lt;string&gt; Authenticate(
      string tenant, string clientId, 
      string appKey, string resource)
  
  {
      var authority = $"https://login.windows.net/{tenant}/oauth2/token";
      var credential = new ClientCredential(clientId, appKey);
      var authContext = new AuthenticationContext(authority);
      var result = await authContext.AcquireTokenAsync(resource, credential);
      return result.AccessToken;
  }
  </code></pre>
  
  <p>, where <code>tenant</code> is our organisation's ID ("XXXX.onmicrosoft.com"), <code>clientId</code> is the Application ID of the new service (consumer), <code>appKey</code> is the generated key, and <code>resource</code> is the Application ID of the target Web application we need access to.</p>
  
  <p>This worked, until we faced a case when the access to the target application was restricted by enabling the "User assignment required?" switch and listing the allowed users explicitly in the app settings. After that, this code started failing with the following message:</p>
  
  <blockquote>
    <p>Microsoft.IdentityModel.Clients.ActiveDirectory.AdalServiceException:
    AADSTS50105: Application '{our client id}' is not assigned to a role for the application '{target web app}'.</p>
  </blockquote>
  
  <p>It turns out this setting sets the <code>appRoleAssignmentRequired</code> property in the target application's ServicePrincipal to <code>true</code>. Googling confirmed that Azure AD stores the list of allowed principals in the <code>AppRoleAssignment</code> entities for the application' s Service Principal, and does not issue tokens to clients NOT in that list.</p>
  
  <p>There seems to be no UI to add applications (not users) to that list. Now, the Azure AD Graph API comes to play. We were are able to   examine the list of assigned users by using the following query:</p>
  
  <pre><code>https://graph.windows.net/{tenant}/servicePrincipals/{id}/appRoleAssignedTo
  </code></pre>
  
  <p>(<code>id</code> is the service principal of the target application, plus the request should have a valid Bearer token).</p>
  
  <p>Unfortunately, we could not figure any way of adding our application (service principal) to this list. </p>
  
  <p>We tried both the Azure AD Graph (graph.windows.net) and Microsoft Graph API (graph.microsoft.com). The first method is mentioned in <a href="https://blogs.msdn.microsoft.com/aadgraphteam/2014/12/12/announcing-the-new-version-of-graph-api-api-version1-5/" rel="nofollow noreferrer">this post</a>, along with the note it is broken:</p>
  
  <blockquote>
    <p>NOTE:  Currently assignment of a service principal to a resource is broken and we’ll work to fix this problem, and update this post when it’s fixed.</p>
  </blockquote>
  
  <p>The second method is documented <a href="https://graph.microsoft.io/en-us/docs/api-reference/beta/api/approleassignment_update" rel="nofollow noreferrer">here</a>, and was referenced <a href="https://stackoverflow.com/questions/40731389/microsoft-azure-graph-api-approleassignedto-not-working">in this Stack Overflow post</a>, again with a mention that there is a bug.</p>
  
  <p>Am I missing something really simple here? Does AppRoleAssignment support adding applications at all? Will it resolve our restricted access problem?</p>
  
  <p>Thanks,
  Vitaly</p>