title: Azure AD Authentication 401 error "the audience is invalid" AddAzureADBearer .Net Core Web Api
body: <p>I'm trying to create a simple example of Azure AD authentication <a href="https://mobilefirstcloudfirst.net/2019/08/adding-azure-active-directory-authentication-connect-angular-app-asp-net-core-web-api-using-msal/" rel="noreferrer">using this sample</a> except for my client is JQuery. I am not sure why I get the 401 error about the audience is invalid when the token shows the audience is <code>https://myportal.onmicrosoft.com/test_core_web_api_spa</code>. This matches the API definition in Azure. The only missing piece is the custom scope of <code>user_impersonation</code> but when I make the call using MSAL <code>clientApplication.acquireTokenSilent(tokenRequest2)</code> to acquire the token it my scopes matches the full URL of the API with scope:</p>
  
  <pre><code>const tokenRequest2 = {
      scopes: ["https://myportal.onmicrosoft.com/test_core_web_api_spa/user_impersonation"]
  };
  </code></pre>
  
  <p>In the API to establish authentication I am using this code (I noticed not many examples use this method)</p>
  
  <pre><code>services.AddAuthentication(AzureADDefaults.BearerAuthenticationScheme)
     .AddAzureADBearer(options =&gt; Configuration.Bind("AzureAd", options));
  </code></pre>
  
  <p>And the configuration for the API is</p>
  
  <pre><code>  "AzureAd": {
      "Instance": "https://login.microsoftonline.com/",
      "Domain": "myportal.onmicrosoft.com",
      "TenantId": "my-tenant-guid",
      "ClientId": "my-api-client-guid"
    },
  </code></pre>
  
  <p>I've noticed many examples showing a different format for the API (I assume these are older version) but the exposed API scope is listed in Azure as <code>https://myportal.onmicrosoft.com/test_core_web_api_spa/user_impersonation</code>. I have also added the guid of the client using the Azure dashboard to access this exposed API scope. </p>
  
  <p>Any ideas where I have gone wrong? Alternately, any simple examples using MSAL, JQuery for the client, and a simple .Net Core Web Api? Seems like all the examples I find are out of date or use a different client or a different authentication method. </p>
  
  <p><strong>Update to show expose api settings in Azure for web api app.</strong>
  I've added an image from Azure showing the settings for the "expose an api" screen. I've added the custom scope <code>user_impersonation</code> then added the client and granted it access to that scope. As you can see my Azure subscription does not have the <code>api://guid</code> format that is seen by others. When I try to use that <code>api://guid</code> format I get the error <code>The resource principal named api://guid was not found in the tenant</code>.</p>
  
  <p>I also added image of the token. The <code>aud</code> tag matches my web api app name in Azure. And the <code>scp</code> lists the scope that I attached to my scopes request. I just cannot see what else to try.</p>
  
  <p><a href="https://i.stack.imgur.com/OgDqM.jpg" rel="noreferrer"><img src="https://i.stack.imgur.com/OgDqM.jpg" alt="enter image description here"></a></p>
  
  <p><a href="https://i.stack.imgur.com/o3pQs.jpg" rel="noreferrer"><img src="https://i.stack.imgur.com/o3pQs.jpg" alt="expose api settings for web api"></a></p>