title: Is this the proper way to use MSAL for python to authenticate a user for web app using id_token_claims?
body: <h1>Background:</h1>
  
  <p>I have successfully setup <a href="https://github.com/AzureAD/microsoft-authentication-library-for-python/blob/dev/sample/authorization-code-flow-sample/authorization_code_flow_sample.py" rel="nofollow noreferrer"><strong>this website sample code using MSAL for python</strong></a>. This example works with the Microsoft Graph API permissions in Azure AD, asks user to give consent and gets the expected result that looks similar to:</p>
  
  <pre><code>{
      "token_type": "Bearer",
      "access_token": "eyJ0...",
      "refresh_token": "OAQ...",
      "id_token": "eyJ...",
      ...
  
      "id_token_claims": {
          "aud": "289...",
          "iss": "https://login.microsoftonline.com/f645ad92-e38d-4d1a-b510-d1b09a74a8ca/v2.0",
          "iat": 1559626249,
          "nbf": 1559626249,
          "exp": 1559630149,
          "aio": "ATQ...",
          "name": "Cloud IDLAB Basic User",
          "oid": "9f4...",
          "preferred_username": "idlab@msidlab4.onmicrosoft.com",
          "sub": "4mB...",
          "tid": "f64...",
          "uti": "91H...",
          "ver": "2.0"
      }
  }
  </code></pre>
  
  <p>My configuration is the same as the sample code but with my own Azure AD <code>client_secret</code> and <code>client_id</code>:</p>
  
  <pre><code>{
      "authority": "https://login.microsoftonline.com/organizations",
      "client_id": "my_client_id",
      "scope": ["https://graph.microsoft.com/.default"],
      "redirect_uri": "http://localhost:5000/getAToken",
      "client_secret": "mysecret"
  }
  </code></pre>
  
  <h1>Goal:</h1>
  
  <p>What I hope to do is only use MSAL to authenticate a user. In this case <a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/id-tokens" rel="nofollow noreferrer">all I need is the <code>id_token</code></a>. Thanks to MSAL I can use the <code>id_token_claims</code> from the result (see above example) which is the <a href="https://github.com/AzureAD/microsoft-authentication-library-for-python/blob/80eac92474b8315e794d78a60c76169bb80d300b/msal/oauth2cli/oidc.py#L14" rel="nofollow noreferrer">validated and decoded <code>id_token</code> claims</a>.</p>
  
  <h1>Question:</h1>
  
  <p><strong>Is this the correct way to use MSAL to authenticate a user?</strong> I do not need an <code>access_token</code> because I'm not wanting to call any other APIs. </p>
  
  <p>It feels a little weird that I'm making a request that includes an 'access_token` for microsoft graph in it's response but not making a call to the graph api (as is done in this <a href="https://github.com/Azure-Samples/active-directory-python-webapp-graphapi#overview" rel="nofollow noreferrer">ADAL sample</a>).</p>
  
  <p>It may be completely legit that MSAL is returning everything that someone may need regardless if they use them. I just want to be sure that I'm using MSAL properly. Maybe my scope should be different (e.g. my <a href="https://github.com/AzureAD/microsoft-authentication-library-for-python/blob/80eac92474b8315e794d78a60c76169bb80d300b/msal/application.py#L40" rel="nofollow noreferrer"><code>client_id</code> maybe based on the comments in the code</a>)?</p>