MSAL Angular login Invalid access token starts with 'Ew' from common tenant while users logging to my application

Question

i wish you all a wonderfull day.

We've a enterprise application registration application on azure and also we've a Angular(SPA) application with that users will login and get access token with MSAL login popup.

I've configured MSAL Configuration as on my standalone component:

new PublicClientApplication({ // MSAL Configuration
        auth: {
          clientId: "my-hidden-client-id",
          authority: "https://login.microsoftonline.com/common/",
          redirectUri: "http://localhost:8105/integration/email/outlook"
        },

My login popup configuration as:

After that i'm asking for permissions to get their some informations.By the way on portal.azure.com i've added a few api permissions to our enterprise application registration to add those permissions adding as scope array in jwt token.

But the access_token field of return model is not a jwt token, it starts as "Ew" i cant use it to initializing graph client in .Net. Access token of return model is like: "accessToken":"EwCAA8l6BA...". So how can i get a access token as JWT Bearer Token with "https://login.microsoftonline.com/common" url while logging in to Microsoft. What am i missing about that. Or how can i use that "accessToken":"EwCAA8l6BA..." token to initialize graph client with OnBehalfOfCredential authentication to Entra ID.

Hopefully i hope we'll find a solution about it.

Answer 1

Note that: If you are using a personal Microsoft account to sign in, the access token will start with Ew...

I signed in with the personal Microsoft account:

For sample, I generated access token via Postman:

https://login.microsoftonline.com/common/oauth2/v2.0/token

client_id:ClientID
grant_type:authorization_code
code:code
redirect_uri:https://jwt.ms
code_verifier:S256
scope:https://graph.microsoft.com/.default

The access token started with Ew as I signed with personal account.

By using the above access token, I can call the Microsoft Graph API successfully:

https://graph.microsoft.com/v1.0/me/calendar

Otherwise, make use of using id token to initialize graph client for all account types.