As part of that authentication, Azure AD will return the ID and Access tokens.

Something cool though has been setup behind the scenes.

The Azure AD web application was granted permission to that scope.Īnd in that application a scope or permission was defined.

And then during the authentication process, that scope is put into a claim inside the access token.

Tokens, claims, scopes - there's a method to all the madness! I hope all of the concepts we talked about in the first articles are coming together now.

The web application will then send a request to a Web API that's also registered with Azure AD.

The API will check that token and scope against Azure AD and then will process to process the request, or reject it.Īnd as mentioned, the scope is a part of that.

It should be noted that no user-level authorization is going on here. The scope and the token in general are being checked as being valid.

But no checks as to whether the user has access to the particular resource is happening. You can think of a scope as a permission at the Azure AD application level. One Azure AD application says I have these scopes and they'll do certain things. (Like read and write products from a database.) Then those scopes are granted to other Azure AD applications. And a user (or admin of Azure AD) consents that the calling application can use the scope(s). So even though an API may have a scope that says if you can access me, you can read & write products from a database.

#Identity api scope approval ui mac application series#.#Identity api scope approval ui mac application how to#.