title: Microsoft Azure access_token not accepted in CRM requests
body: <p>I am putting together an api integration with Dynamics CRM on premise (v8.1/8.2), on a IFD, using the password grant type.</p>
  
  <p>I am retrieving an access token successfully, however when I then try to call endpoints (e.g /api/data/v8.2/contacts?$select=fullname,contactid ) I get 401 - access denied errors. When I log into the CRM with the user I can successfully view this data and the error occurs on all tested endpoints.</p>
  
  <p>Interestingly this morning I realised the tokens retrieved cannot be base64 decoded - is that correct?</p>
  
  <p>I could use some ideas on what to look at next to resolve the problem. Steps I've taken:</p>
  
  <ul>
  <li>Triple checking the initial token request</li>
  <li>Triple checked the Service Root URL</li>
  <li>Tried on two CRM/Azure setups</li>
  <li>Tried with my own (node) code and internet examples</li>
  <li>A wide variety of token setups</li>
  <li>Confirmed the user exists in Azure and the CRM</li>
  <li>Confirmed user has sufficient permissions</li>
  <li>Confirmed the application on Azure has all dynamics permissions granted</li>
  <li>Confirmed I am on the same network as Azure and the CRM</li>
  </ul>
  
  <p>It seems apparent that I have a configuration issue somewhere in Azure or the CRM. However no guide or question I can find suggests looking at problems I haven't already checked for and I could really use some input from those who have had to make adjustments in obscure settings ect.</p>
  
  <p>Heres my token request:</p>
  
  <pre><code>var options = {
      method: 'POST',
      url: 'https://login.microsoftonline.com/&lt;snip&gt;/oauth2/token', //for 'intercity technology' (guid is unique)
      headers:
          {
              'cache-control': 'no-cache',
              'content-type': 'multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW' },
      formData:
          {
              grant_type: 'password',
              client_id: ‘&lt;snip&gt;’, //aplication id
              client_secret: ‘&lt;snip&gt;’, //any key in the keys list
              username: ‘&lt;snip&gt;’,
              password: ‘&lt;snip&gt;’, // and their password
              resource: ‘&lt;snip&gt;’ //application id
  
          }
  };
  
  
     logger.debug(util.inspect(options));
  
      request(options, function (error, response, body) {
  ...
  </code></pre>
  
  <p>Heres my current api request test:</p>
  
  <pre><code> var options = {
              method: 'GET',
              url: organisation_url + '/api/data/v8.2/contacts?$select=fullname,contactid',
              headers: {
                  Authorization: 'Bearer '+token,
                  Accept: 'application/json',
                  'OData-MaxVersion':4.0,
                  'OData-Version': 4.0,
                  'Content-Type': 'application/json; charset=utf-8',
                  'Prefer': 'odata.maxpagesize=500',
                  'Prefer': 'odata.include-annotations=OData.Community.Display.V1.FormattedValue'
              }
              };
              logger.debug(util.inspect(options));
  
              request(options, function (error, response, body) {
  ...
  </code></pre>