App-only tokens for single-tenant applications are only issued if the client app exists in the resource tenant

Effective date: July 26, 2019 Endpoints impacted: Both v1.0 and v2.0 Protocol impacted: Client Credentials (app-only tokens) A security change took effect on July 26, 2019 changing the way app-only tokens (via the client credentials grant) are issued. Previously, applications were allowed to get tokens to call any other app, regardless of presence in the tenant or roles consented to for that application. This behavior has been updated so that for resources (sometimes called web APIs) set to be single-tenant (the default), the client application must exist within the resource tenant. Existing consent between the client and the API is still not required, and apps should still be doing their own authorization checks to ensure that a roles claim is present and contains the expected value for the API. The error message for this scenario currently states: The service principal named was not found in the tenant named . This can happen if the application has not been installed by the administrator of the tenant. To remedy this issue, use the Admin Consent experience to create the client application service principal in your tenant, or create it manually. This requirement ensures that the tenant has given the application permission to operate within the tenant. Example request https://login.microsoftonline.com/contoso.com/oauth2/authorize?resource=https://gateway.contoso.com/api&response_type=token&client_id=00001111-aaaa-2222-bbbb-3333cccc4444&... In this example, the resource tenant (authority) is contoso.com, the resource app is a single-tenant app called gateway.contoso.com/api…