Microsoft Graph API not returning refresh token

Question

I created an app on https://apps.dev.microsoft.com

with the following Application Permissions:

Calendars.Read (Admin Only) Calendars.ReadWrite (Admin Only) User.Read.All (Admin Only)

The following is the only flow that has worked for me to be able to subscribe to notifications of another user, on another tenant, as described here

Admin Consent

Admin consent was then successfully granted via this URL

https://login.microsoftonline.com/common/adminconsent?client_id=bbb35336-faee-4c10-84b4-34136634db41&state=1234&redirect_uri=https%3A%2F%2Fdashmeetings.com%2Fmicrosoft%2Foauth

Get access token

An access token was then obtained from

POST https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token

with headers

Content-Type=application/x-www-form-urlencoded

with {tenant} the value of tenant returned in the callback url,

and body with key-value pairs

grant_type=client_credentials
client_id=bbb35336-faee-4c10-84b4-34136634db41
client_secret=xxx
scope=https://graph.microsoft.com/.default

This returns an access token, but not a refresh token.

I think this might be because offline_access isn't requested.

How can I get a refresh token?

Marc LaFleur · Accepted Answer · 2017-12-01 19:59:52Z

22

You're partially correct, you will only receive a refresh_token if you request the offline_access scope and you are using the authorization_code grant flow.

Refresh tokens are not available when using the implicit grant and are unnecessary when using the client_credentials grant. When using client_credentials there isn't a user authenticated and therefore there isn't a need to "refresh" a token since you can simply request a new token when needed.

answered Dec 1, 2017 at 19:59

Marc LaFleur

33.4k4 gold badges41 silver badges71 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Surakshith · Accepted Answer · 2024-03-01 08:53:54Z

2

I had the same issue. I had not used the offline_access scope in the authorization request.

    GET /{tenant}/oauth2/v2.0/authorize?
client_id={client_id}
&response_type=code
&redirect_uri={redirect_uri}
&response_mode=query
&scope=https://graph.microsoft.com/.default offline_access
&state=12345

answered Mar 1, 2024 at 8:53

Surakshith

1512 silver badges6 bronze badges

Comments

Benyamin Jafari · Accepted Answer · 2022-08-06 14:36:28Z

1

If you want to get the refresh_token which is a long-term token you can append the offline_access into your scopes.

Alternativally, you can also use the basic on scope as it cotains the offline_access.

answered Aug 6, 2022 at 14:36

Benyamin Jafari

35.8k35 gold badges161 silver badges184 bronze badges

Comments

karel · Accepted Answer · 2017-12-01 09:35:16Z

0

A refresh_token isn't needed.

As long as the admin consent has not been revoked, a new access_token can be requested when needed.

answered Dec 1, 2017 at 9:35

karel

4985 silver badges16 bronze badges

Collectives™ on Stack Overflow

Microsoft Graph API not returning refresh token

4 Answers 4

Comments

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related