title: Getting 'The token contains no permissions, or permissions can not be understood' in daemon flow office365
body: <p>I had a problem reading all users calendar's which I explained here: <a href="https://stackoverflow.com/questions/37402625/using-microsoft-graph-to-read-all-users-calendars/37403644">Using Microsoft graph to read all users calendars</a> </p>
  
  <p>According to the documentation this was available, however it didn't work and the reply was to best use the flow described in the following article (daemon or service app).</p>
  
  <p><a href="https://blogs.msdn.microsoft.com/exchangedev/2015/01/21/building-daemon-or-service-apps-with-office-365-mail-calendar-and-contacts-apis-oauth2-client-credential-flow/" rel="nofollow noreferrer">https://blogs.msdn.microsoft.com/exchangedev/2015/01/21/building-daemon-or-service-apps-with-office-365-mail-calendar-and-contacts-apis-oauth2-client-credential-flow/</a></p>
  
  <p>Things I did:
  - I registered my web app in Azure portal under active directory.  I set it as a web application (not a native client app).  I set it as multi-tenant and gave application permissions.
  - I make a key, edited manifest and uploaded this.</p>
  
  <p>What I'm doing is:</p>
  
  <p>1) get the tenant ID of the user, at this stage the admin user gives permission.</p>
  
  <p>2) as described in the article: I only use the tenantId that I get back, I don't do anything with the access token.</p>
  
  <p>3) I then get a token from <a href="https://login.windows.net/TENANT_ID/oauth2/token?api-version=1.0" rel="nofollow noreferrer">https://login.windows.net/TENANT_ID/oauth2/token?api-version=1.0</a>  this seems to work as well (after a lot of searching).</p>
  
  <p>4) When I put the access token I got back into <a href="https://jwt.io" rel="nofollow noreferrer">https://jwt.io</a> I get a valid result (or so it seems at least), see here: <a href="https://www.evernote.com/shard/s29/sh/5128795e-e7fd-4b8e-a779-5795cd83a66d/6e67979e1b628b06da60a5dcd5ba99a4" rel="nofollow noreferrer">https://www.evernote.com/shard/s29/sh/5128795e-e7fd-4b8e-a779-5795cd83a66d/6e67979e1b628b06da60a5dcd5ba99a4</a></p>
  
  <p>5) Whatever request I make with the access token afterwards I always get:</p>
  
  <pre><code>The token contains no permissions, or permissions can not be understood.
  </code></pre>
  
  <p>These are the scopes I requested in step 1.</p>
  
  <pre><code>SCOPES = [ "openid" "Calendars.Read", "User.Read.All", "offline_access" ]
  </code></pre>
  
  <p>A couple of questions:</p>
  
  <ul>
  <li>Is it normal that I can throw away the token I get back in step 1 and only use the tenantId.  At this time the user got a message and needed to authorize the site (with the scopes...).  In step 3 the user doesn't get a popup anymore.  If I don't use the token I got then, how can it remember?</li>
  <li>Which endpoints do I need to use?  The post about daemon said <strong><a href="https://outlook.office365.com" rel="nofollow noreferrer">https://outlook.office365.com</a></strong> but when I'm in active directory of Azure in my app config I see <strong><a href="https://graph.windows.net" rel="nofollow noreferrer">https://graph.windows.net</a></strong> if I click the <strong>view endpoints</strong> button.</li>
  <li>In the reply I got on my first question I got: <em>We are working to support the scenario you are requesting (Accessing other users' calendars) but the feature hasn't shipped yet. Stay tuned ...</em>  Maybe I need to wait on that, but is there any indication as to when?  Is this a matter of days?  weeks?</li>
  </ul>