Error : The token does not have one or more required security scopes

[xmoncomble]

Hi

I want to make a simple application that retrives all the print jobs of a specific printer but I encountered an issue when I want to call the api "jobs"

I follow the document "Quickstart: Register an application with the Microsoft identity platform" (https://docs.microsoft.com/fr-fr/azure/active-directory/develop/quickstart-register-app)

1. I Register an new application with the account "Accounts in this organizational directory only"

2. I added a client secret

3. I added the application permission "PrintJob.Read.All", permission to list the print jobs

My application is very simple

1. I retrieve an acces token by calling the url https://login.microsoftonline.com/cartadis.com/oauth2/v2.0/token in POST method with the parameters

  grant_type=client_credentials

  client_id=<id of my app in azure>

  client_secret=<secret of my app>

  scope=https://graph.microsoft.com/.default

2. I call the url https://graph.microsoft.com/beta/print/printers/<id_of_my_printer>/jobs with the token retrieved previously in the header name "Authorization"

But each time, I have a 403 error "The token does not have one or more required security scopes"

I forgot something ? Ideas ?

Thanks in advanced

Regards

[#2]

@xmoncomble for the user account are you are using when calling the Graph API to retrieve the jobs, is the user account assigned the Printer Administrator role and have a Universal Print license?

If the user account already have the right permissions, you can decode the token using JWT Decoder | AD FS Help (microsoft.com) to see what permission scopes the token has.  You can use the "Developer Tools" within the browser to capture the network traffic and looking at the header for the call to the Graph API.  Copy the value after "Bearer" string in the "Authorization:" header and paste it into the decoder.  You'll want to search for "scp" in the decoded result to see what scopes the token is carrying.

HTH,

Jimmy

[#3]

@Jimmy_WuI understood where the problem came from : a permission was missing.
By adding the application permission Printer.ReadWrite.All, my application is now able to list the jobs of my printer