MSAL Authentication with Python Showing Unauthorized Client?

Question

I am trying to authenticate an Azure app that has application-level permissions. All the permissions have been granted by an admin, and the app has both a client id and a client secret. I'm running the following code based on the Daemon-api documentation from Microsoft graph:

import msal

config = {
    "authority": "https://login.microsoftonline.com/organizations",
    "client_id": CLIENT_ID,
    "scope": ["https://graph.microsoft.com/.default"],
    "redirect_uri": REDIRECT_URI,
    "client_secret": CLIENT_SECRET
}

app = msal.ConfidentialClientApplication(
    config["client_id"], authority=config["authority"],
    client_credential=config["client_secret"] )

result = app.acquire_token_silent(config["scope"], account=None)

import logging

if not result:
    logging.info("No suitable token exists in cache. Let's get a new one from AAD.")
    result = app.acquire_token_for_client(scopes=config["scope"])

If I print result though, it says the following:

{'error': 'unauthorized_client',
 'error_description': "AADSTS700016: Application with identifier [IDENTIFIER] was not found in the directory 'microsoft.com'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant.\r\nTrace ID: [TRACE ID]\r\nCorrelation ID: [CORRELATION ID]\r\nTimestamp: 2019-08-28 17:14:39Z",
 'error_codes': [700016],
 'timestamp': '2019-08-28 17:14:39Z',
 'trace_id': [TRACE ID],
 'correlation_id': [CORRELATION ID],
 'error_uri': 'https://login.microsoftonline.com/error?code=700016'}

The app has existed for several days and as I've mentioned, it has had all its permissions authorized by an admin. How come I'm still getting an "unauthorized" error? I check my id and secret, they're correct.

I wonder if it might have something to do with the fact that the error message says it's being sent to the microsoft.com directory? But the only microsoft information I provide is in authority and scope which the api says is needed as-is. I don't see anywhere to provide a directory id. Could that be the issue? If so, how would I rectify it?

Answer 1

Authority field in your config should be

https://login.microsoftonline.com/<directory_id>