Skip to content

Commit 8cb01e7

Browse files
authored
Merge pull request #113832 from pmaytak/main
Add details to msal-net-user-gets-consent-for-multiple-resources.md
2 parents 9f3859a + e820271 commit 8cb01e7

File tree

1 file changed

+5
-5
lines changed

1 file changed

+5
-5
lines changed

articles/active-directory/develop/msal-net-user-gets-consent-for-multiple-resources.md

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ ms.custom: devx-track-csharp, aaddev, devx-track-dotnet
1717
---
1818

1919
# User gets consent for several resources using MSAL.NET
20-
The Microsoft identity platform does not allow you to get a token for several resources at once. When using the Microsoft Authentication Library for .NET (MSAL.NET), the scopes parameter in the acquire token method should only contain scopes for a single resource. However, you can pre-consent to several resources upfront by specifying additional scopes using the `.WithExtraScopeToConsent` builder method.
20+
The Microsoft identity platform does not allow you to get a token for several resources at once. When using the Microsoft Authentication Library for .NET (MSAL.NET), the *scopes* parameter in the acquire token method should only contain scopes for a single resource. However, you can pre-consent to several resources upfront by specifying additional scopes using the `.WithExtraScopesToConsent` builder method.
2121

2222
> [!NOTE]
2323
> Getting consent for several resources works for Microsoft identity platform, but not for Azure AD B2C. Azure AD B2C supports only admin consent, not user consent.
@@ -27,7 +27,7 @@ For example, if you have two resources that have 2 scopes each:
2727
- https:\//mytenant.onmicrosoft.com/customerapi (with 2 scopes `customer.read` and `customer.write`)
2828
- https:\//mytenant.onmicrosoft.com/vendorapi (with 2 scopes `vendor.read` and `vendor.write`)
2929

30-
You should use the `.WithExtraScopeToConsent` modifier which has the *extraScopesToConsent* parameter as shown in the following example:
30+
You should use the `.WithExtraScopesToConsent` method which has the *extraScopesToConsent* parameter as shown in the following example:
3131

3232
```csharp
3333
string[] scopesForCustomerApi = new string[]
@@ -44,12 +44,12 @@ string[] scopesForVendorApi = new string[]
4444
var accounts = await app.GetAccountsAsync();
4545
var result = await app.AcquireTokenInteractive(scopesForCustomerApi)
4646
.WithAccount(accounts.FirstOrDefault())
47-
.WithExtraScopeToConsent(scopesForVendorApi)
47+
.WithExtraScopesToConsent(scopesForVendorApi)
4848
.ExecuteAsync();
4949
```
5050

51-
This will get you an access token for the first web API. Then, to access the second web API you can silently acquire the token from the token cache:
51+
`AcquireTokenInteractive` will return an access token for the first web API. Along with that access token, a refresh token will also be retrieved from Azure AD and cached. Then, to access the second web API, you can silently acquire the token using `AcquireTokenSilent`. MSAL will use the cached refresh token to retrieve from Azure AD the access token for the second web API.
5252

5353
```csharp
54-
AcquireTokenSilent(scopesForVendorApi, accounts.FirstOrDefault()).ExecuteAsync();
54+
var result = await AcquireTokenSilent(scopesForVendorApi, accounts.FirstOrDefault()).ExecuteAsync();
5555
```

0 commit comments

Comments
 (0)