Project Online Authenticate OData Feed using Azure AD and Postman

Question

I have recently spent a substantial amount of time determining how to authenticate an OData feed from Project Online using Azure AD and Postman. There are many posts in different forums about this, but I wasn't able to find a single post that gave a complete working example. Following is the method that I have used.

Answer 1

ASSIGN PERMISSIONS IN PROJECT ONLINE

Open Server Settings / Manage Groups. Choose the Group that you want to allow to access the OData Feed and Ensure it has the Access Project Server Reporting Service under General in Global Permissions ticked.

CONFIGURE AZURE AD

Register a new app in Azure.

Define the Redirect Uri. (For postman, use https://oauth.pstmn.io/v1/callback)

Define a client secret

CONFIGURE POSTMAN

Create a new Request and define a Get query along the lines of the following. https://[Your Domain].sharepoint.com/sites/pwa/_api/ProjectData/Projects
This requests a list of projects.

Under params, add a new key accept = application/json if you want Json output. default is XML

Under Authorization Tab, choose the following:

• Type = OAuth 2.0
• Access Token = Available Tokens
• Header Prefix = Bearer
• Token Name = [Any Name you want]
• Grant Type = Authorization
• Code Callback URL = [tick Authorize Using Browser. This will then default to https://oauth.pstmn.io/v1/callback]
• Auth URL = https://login.microsoftonline.com/common/oauth2/v2.0/authorize
• Access Token URL = https://login.microsoftonline.com/common/oauth2/v2.0/token
• Client ID = [From Azure AD] Client Secret = [From Azure AD]
• Scope = https://[Your Tenant Name].sharepoint.com/ProjectWebAppReporting.Read
• State = [Anything you want]
• Client Authentication = Send client credentials in body.

If you enter all of this correctly and then press Get New Access Token, you should see a browser open, enter your credentials and then a token should return to Postman as shown in screenshots below. Press Use Token.

Note, if you are interested to see what the token contains, you can decode it at https://jwt.io/

At this point, press Send, run your query and confirm that the Body contains odata output.

EDIT NOTE: I have made multiple adjustments to this answer as I identified and resolved multiple roadblocks that I encountered. It turned out to be quite simple in the end, but the key concept that was needed to get this right was that the Scope parameter needed to be targeted to the PWA site. ie. https://[your tenant name].sharepoint.com.au/user.read