title: Azure AD - get user's profile photo, OAUTH access failure
body: <p>I'm trying to access the signed in user's Profile Photo in the context of an email app which uses EWS to connect to Office 365.</p>
  
  <p>The app is registered on portal.azure.com with the following required permissions:</p>
  
  <ol>
  <li>Office 365 Exchange Online -> Access mailboxes as the signed-in user via Exchange Web Services</li>
  <li>Windows Azure Active Directory -> Sign in and read user profile</li>
  </ol>
  
  <p>The EWS part works just fine, I'm able to sign the user in, get the access and refresh tokens, and perform EWS operations using "Authorization: Bearer access_token".</p>
  
  <p>The part I'm having trouble with is getting the user's profile photo.</p>
  
  <p>This is the docs I'm going by:</p>
  
  <p><a href="https://msdn.microsoft.com/en-us/office/office365/api/photo-rest-operations" rel="nofollow noreferrer">https://msdn.microsoft.com/en-us/office/office365/api/photo-rest-operations</a></p>
  
  <p>The API endpoint I'm trying to use is:</p>
  
  <p>GET <a href="https://outlook.office.com/api/v2.0/me/photo" rel="nofollow noreferrer">https://outlook.office.com/api/v2.0/me/photo</a></p>
  
  <p>... with "Authorization: Bearer access_token" header.</p>
  
  <p>The above API returns this response:</p>
  
  <blockquote>
    <p>HTTP 403
    {"error":{"code":"ErrorAccessDenied","message":"Access is denied.
    Check credentials and try again."}}</p>
  </blockquote>
  
  <p>What could be wrong?</p>
  
  <ol>
  <li>According to the above docs, getting user's photo should be possible using the user.read scope.</li>
  <li>The "Sign in and read user profile" permission I mentioned above has a tooltip saying "User.Read", so I believe that's the right scope</li>
  </ol>
  
  <p><a href="https://i.stack.imgur.com/ovPxD.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/ovPxD.png" alt="Azure AD User.Read permission / scope"></a></p>
  
  <p>I've tried decoding my access token at jwt.io, it has: <code>"scp": "full_access_as_user"</code> - where is my User.Read scope, or does "full access" include "user.read"?</p>
  
  <p>Any ideas?</p>