title: MSAL On-Behalf-Of (OBO) throws IDW10502: An MsalUiRequiredException was thrown due to a challenge for the user
body: <p>Goal: MasterAPI to perform <strong>On-Behalf-Of</strong> flow to DownstreamAPI</p>
  <p>Actors:</p>
  <ul>
  <li>Azure AD (Authentication Server)</li>
  <li>Public SPA (Client)</li>
  <li>MasterAPI (Resource Server)</li>
  <li>DownstreamAPI (Resource Server)</li>
  </ul>
  <p>Flow:</p>
  <ul>
  <li>Public SPA client calls Azure <code>/authorize?scope=api://MasterAPI/access_as_user</code> using Authorization Code plus PKCE and receives an ID token</li>
  <li>Public SPA calls Azure <code>/token</code> and receives an access token</li>
  <li>Public SPA calls MasterAPI with the access token</li>
  <li>MasterAPI runs <code>IDownstreamWebAPI.CallWebApiForUserAsync()</code>.</li>
  <li>An exception is thrown: <a href="https://github.com/AzureAD/microsoft-identity-web/wiki/Managing-incremental-consent-and-conditional-access" rel="nofollow noreferrer">conditional access</a>
  <ul>
  <li>In my public SPA I add both scopes to MSAL.js but it still throws an exception.</li>
  </ul>
  </li>
  </ul>
  <p>MasterAPI:</p>
  <pre class="lang-cs prettyprint-override"><code>await invoicingWebApi.CallWebApiForUserAsync&lt;object, object&gt;(&quot;DownstreamAPI&quot;, &quot;&quot;,
  options =&gt;
  {
    options.HttpMethod = HttpMethod.Post;
    options.RelativePath = $&quot;test&quot;;
  });
  </code></pre>
  <p>MasterAPI response:</p>
  <pre><code>IDW10502: An MsalUiRequiredException was thrown due to a challenge for the user. See https://aka.ms/ms-id-web/ca_incremental-consent
  </code></pre>