title: Azure: Unable to use RefreshToken to acquire a new AccessToken
body: <p>I'm building an application that needs access to our clients' <a href="https://msdn.microsoft.com/en-us/office-365/office-365-management-activity-api-reference">Office 365 Management Activities</a>. I've followed the steps outlined in <a href="https://azure.microsoft.com/en-us/documentation/articles/active-directory-protocols-oauth-code">this Azure Active Directory</a> overview, and am able to use the OAuth code to acquire an initial Access Token, as well as use this token to set up O365 subscriptions. </p>
  
  <p>However, when I use the <code>refresh_token</code> provided with my initial token to acquire a new Access Token, I get the following error: </p>
  
  <blockquote>
    <p>{"error_description":"AADSTS65001: The user or administrator has not consented to use the application with ID '8f72f805-dfd2-428d-8b0e-771a98d26c16'. Send an interactive authorization request for this user and resource.\r\nTrace ID: df229c3f-8f28-420b-9ac3-321ab1b2ad09\r\nCorrelation ID: 0e0f2bcb-4b19-458a-8556-2a6d4e51379f\r\nTimestamp: 2016-10-03 17:33:20Z","error":"invalid_grant"}</p>
  </blockquote>
  
  <p>Since I'm able to acquire and use the initial Access Token, I'm pretty sure that the user is granting my applications <em>some</em> permissions. Is there a specific permission that I need in order to acquire a new Access Token using the Refresh Token?</p>
  
  <p><strong>Edit:</strong>
  Specifically, I'm using the <code>com.microsoft.azure::adal4j</code> <a href="https://github.com/AzureAD/azure-activedirectory-library-for-java">java package</a>, AuthenticationContext class, <a href="https://github.com/AzureAD/azure-activedirectory-library-for-java/blob/dev/src/main/java/com/microsoft/aad/adal4j/AuthenticationContext.java#L404">acquireTokenByAuthorizationCode</a> and <a href="https://github.com/AzureAD/azure-activedirectory-library-for-java/blob/dev/src/main/java/com/microsoft/aad/adal4j/AuthenticationContext.java#L685">acquireTokenByRefreshToken</a> methods:</p>
  
  <pre><code>public class AzureProvisioner {
      private final AuthenticationContext authService = new AuthenticationContext(
              "https://login.windows.net/common/oauth2/token", true, Executors.newSingleThreadExecutor());
      private final ClientCredential clientCredential = new ClientCredential("azureAppId", "azureAppSecret");
      public static final String resource = "https://manage.office.com";
      // Internal implementation of REST interface; Microsoft didn't provide a Java Library
      final Office365ManagementApi managementApi;
  
      public void acquireToken(final String authCode, final URI redirectUri) {
          final AuthenticationResult authResult = authService.acquireTokenByAuthorizationCode(
                  authCode, redirectUri, clientCredential, resource, null).get()
          // internal library code, gets the "tid" field from parsing the JWT token
          final String tenantId = JwtAccessToken.fromToken(authResult.getAccessToken()).getTid();
  
          // works
          createInitialSubscription(customerId, authResult.getAccessToken(), tenantId);
  
          // throws an error
          final AuthenticationResult refreshResult = authService.acquireTokenByRefreshToken(
                  authResult.getRefreshToken(), clientCredential, null).get();
      }
  
      private void createInitialSubscription(final String accessToken, final String tenantId) {
          final String authHeader = "Authorization: Bearer " + accessToken;
          final String contentType = "Audit.AzureActiveDirectory";
          // internal implementation
          final CreateWebhookRequest requestBody = new CreateWebhookRequest();
          managementApi.createSubscription(authHeader, tenantId, contentType, requestBody);
      }
  }
  </code></pre>
  
  <p>The same code, without any external dependencies, also does not work for me: </p>
  
  <pre><code>public class AzureProvisioner {
      private final AuthenticationContext authService = new AuthenticationContext(
              "https://login.windows.net/common/oauth2/token", true, Executors.newSingleThreadExecutor());
      private final ClientCredential clientCredential = new ClientCredential("8f72f805-dfd2-428d-8b0e-771a98d26c16", "secret");
      public final String resource = "https://manage.office.com";
      private URI redirectUri = new URI("https://localhost");
  
      private static final String oAuthUrl = "https://login.windows.net/common/oauth2/authorize?response_type=code&amp;client_id=8f72f805-dfd2-428d-8b0e-771a98d26c16&amp;resource=https%3A%2F%2Fmanage.office.com&amp;redirect_uri=https%3A%2F%2Flocalhost";
  
      public AzureProvisioner() throws Exception {
          // do nothing
      }
  
      public static void main(String... args) throws Exception {
          final String authCode = "AQABAAAAAADRNYRQ3dhRSrm...";
          new AzureProvisioner().acquireToken(authCode);
      }
  
      public void acquireToken(final String authCode) throws Exception {
          final AuthenticationResult authResult = authService.acquireTokenByAuthorizationCode(
                  authCode, redirectUri, clientCredential, resource, null).get();
          System.out.println(authResult.getAccessToken());
  
          // throws an error
          final AuthenticationResult refreshResult = authService.acquireTokenByRefreshToken(
                  authResult.getRefreshToken(), clientCredential, resource, null).get();
          System.out.println(refreshResult.getAccessToken());
      }
  }
  </code></pre>
  
  <p>Using a proxy, I took a trace of the https refresh request:</p>
  
  <pre><code>Method: POST
  Protocol-Version: HTTP/1.1
  Protocol: https
  Host: login.windows.net
  File: /common/oauth2/token
  Content-Type: application/x-www-form-urlencoded; charset=UTF-8
  Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
  Connection: keep-alive
  Content-Length: 876
  
  refresh_token={token}
  &amp;resource=https%3A%2F%2Fmanage.office.com
  &amp;grant_type=refresh_token
  &amp;scope=openid
  &amp;client_secret={secret}
  &amp;client_id=8f72f805-dfd2-428d-8b0e-771a98d26c16
  </code></pre>