RFC 6750 (OAuth 2.0 Bearer Token Usage) section 3 allows a scope attribute in the WWW-Authenticate response header field. Power Query should honor this scope, if present, when obtaining access tokens from Entra. This would support "Scenario 1 - Client app authorizes directly to backend" for Azure API Management, as described here: https://learn.microsoft.com/en-us/azure/api-management/authentication-authorization-overview#scenario-1---client-app-authorizes-directly-to-backend
2 Comments
For example, if the Web data source returns this in the 401 response
WWW-Authenticate: Bearer authorization_uri=entra_authorization_endpoint, scope=some_scope
Power Query would use scope=some_scope in the OIDC redirect to authorization_uri
- Status added:New
