title: Azure Function with Azure AD Authentication - Allowed Token Audiences not work for Microsoft Graph
body: <p>I have configured Azure Function with Azure AD auth, follow this doc - <a href="https://docs.microsoft.com/en-us/azure/app-service/configure-authentication-provider-aad#-enable-azure-active-directory-in-your-app-service-app" rel="nofollow noreferrer">Enable Azure Active Directory in your App Service app</a>.</p>
  <p>After the configuration, it will add the function app url e.g. <code>https://appname.azurewebsites.net</code> to the <code>Allowed Token Audiences</code> like below automatically, then we can easily use the <a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow" rel="nofollow noreferrer">client credential flow</a> to get the token to call the e.g. http trigger in my function app.</p>
  <p><a href="https://i.stack.imgur.com/16Ezz.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/16Ezz.png" alt="enter image description here" /></a></p>
  <p>If I add the Azure AD Graph resource url <code>https://graph.windows.net</code> to the <code>Allowed Token Audiences</code>, I can also use this flow to get the token to call my function.</p>
  <p><a href="https://i.stack.imgur.com/P1f36.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/P1f36.png" alt="enter image description here" /></a></p>
  <p><a href="https://i.stack.imgur.com/f248s.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/f248s.png" alt="enter image description here" /></a></p>
  <p>But if I add the Microsoft Graph resource url <code>https://graph.microsoft.com</code> and get the token to call the function, I will get the error.</p>
  <blockquote>
  <p>You do not have permission to view this directory or page.</p>
  </blockquote>
  <p><a href="https://i.stack.imgur.com/V0kQg.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/V0kQg.png" alt="enter image description here" /></a></p>
  <p><a href="https://i.stack.imgur.com/YLEff.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/YLEff.png" alt="enter image description here" /></a></p>
  <p>How to solve this issue? Is this correct usage of <code>Allowed Token Audiences</code>? If not, why the <code>https://graph.windows.net</code> work fine?</p>
  <p>Any ideas are appreciated.</p>