Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
20,369 questions
Unable to get entra support from Microsoft
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(112.00000000000001, 78%, 20%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ELM%3C/text%3E%3C/svg%3E)
Larry Martell
0
Reputation points
I opened a level B support ticket on June 21 and have yet to receive any response. This is a critical issue for us. What can I do to get support?
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(281.6, 17%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGM%3C/text%3E%3C/svg%3E)
Givary-MSFT 30,251 Reputation points Microsoft Employee2024-07-01T04:00:36.67+00:00 @Larry Martell Thank you for reaching out to us, please help us with support ticket details to track the case internally.
-
Larry Martell 0 Reputation points
2024-07-01T18:22:54.44+00:00 Support request ID: 2406210010005913
-
Givary-MSFT 30,251 Reputation points Microsoft Employee
2024-07-02T06:56:52.95+00:00 @Larry Martell Thank you for sharing the case details, I have escalated to my team internally to review this at earliest. Appreciate if you can share the issue details in the meantime we can try to help you.
-
Larry Martell 0 Reputation points
2024-07-02T13:46:16.2833333+00:00 We have 4 issues:
- We get a token back and the corresponding pubic key we get back that matches the kid fails validation.
- Reading on stack overflow and github others have had a similar issue and the suggestion was to use V2 keys. We made the change in our manafest but we still get V1 keys.
- We get an unexpected audience in the token: 00000003-0000-0000-c000-000000000000. This was in our manifest (that was generated by you); we changed it to our tennent id but we still get the 00000... value.
- we do not get back an email claim
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(188.79999999999998, 26%, 28%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EN%3C/text%3E%3C/svg%3E)
Navya 6,200 Reputation points Microsoft Vendor2024-07-03T17:07:53.02+00:00 1.Can you please check the
accessTokenAcceptedVersionin your Manifest's file. To get V2.0 token, change the accessTokenAcceptedVersion to 2 like below and generate token usingv2.0token endpoint: https://login.microsoftonline.com/<tenantID>/oauth2/v2.0/token2.Aud value identifies the intended recipient of the token. Have you exposed an API and added scope like below:
And you make sure to pass scope as
api://AppID/.defaultwhile requesting for token.3.Can you try to set
scope=api://{app id}/.default openidto get email claim in token.Hope this helps. Do let us know if you any further queries.
Thanks,
Navya.
-
Larry Martell 0 Reputation points
2024-07-04T00:12:32.4+00:00 - Yes, we already had 2 in that field:
We request a token from here: https://login.microsoftonline.com/<tenant_id>/oauth2/v2.0/authorize
We get back a v1 token and when we retrieve the public key for the kid it fails validation.
2. Yes, we exposed an API, but we do not have anything in scope. What should be in that field?
3. I tried passing in api://{app id}/.default openid for scope, still do not get the email claim. - Yes, we already had 2 in that field:
Sign in to comment