title: Azure API Management: authorization with Oauth2 401 gives "Unauthorized. Access token is missing or invalid."
body: <p>I have a few APIs (Logic Apps, Functions) that I want to expose through Azure API Management.
  They work fine, so I decided to add OAuth2 autorization.</p>
  
  <p>I followed step by step <a href="https://docs.microsoft.com/fr-fr/azure/api-management/api-management-howto-protect-backend-with-aad" rel="nofollow noreferrer">https://docs.microsoft.com/fr-fr/azure/api-management/api-management-howto-protect-backend-with-aad</a>:</p>
  
  <ul>
  <li>Register an application (backend-app) in Azure AD to represent the API. </li>
  <li>Register another application (client-app) in Azure AD to represent a client application that needs to call the API. </li>
  <li>In Azure AD, grant permissions to allow the client-app to call the backend-app. </li>
  <li>Configure the Developer Console to call the API using OAuth 2.0 user authorization. </li>
  <li>Add the validate-jwt policy to validate the OAuth token for every incoming request. </li>
  <li>Also use Postman to test</li>
  </ul>
  
  <p>Everything works until the "validate-jwt" policy step.
  When I add it, I get a "401 - Unauthorized. Access token is missing or invalid."
  I can get the token, in Developer Console and Postman, but as soon as I do the API call... 401!</p>
  
  <p>When I used jwt.ms to check the content of the token, I noticed that the <strong>aud</strong> param has nothing to do with the backend Application ID.
  The value in the token is "00000003-0000-0000-c000-000000000000", whereas the backend app ID is like "16caXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXc0".</p>
  
  <p>I'm running out of ideas and need the help of some Azure gurus out there!
  Help would be very much appreciated...</p>
  
  <p>Here below the inbound policy as per the MS doc:</p>
  
  <pre><code>&lt;policies&gt;
      &lt;inbound&gt;
          &lt;validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Unauthorized. Access token is missing or invalid."&gt;
              &lt;openid-config url="https://login.microsoftonline.com/MY_AD_TENANT_ID/.well-known/openid-configuration" /&gt;
              &lt;required-claims&gt;
                  &lt;claim name="aud"&gt;
                      &lt;value&gt;MY8BACKEND_APP_ID_GUID&lt;/value&gt;
                  &lt;/claim&gt;
              &lt;/required-claims&gt;
          &lt;/validate-jwt&gt;
      &lt;/inbound&gt;
      &lt;backend&gt;
          &lt;forward-request /&gt;
      &lt;/backend&gt;
      &lt;outbound /&gt;
      &lt;on-error /&gt;
  &lt;/policies&gt;
  </code></pre>
  
  <p><a href="https://i.stack.imgur.com/fQWhU.jpg" rel="nofollow noreferrer">Screen cap of the Postman screen where I get the token (this works, but then when I send the request --> 401)</a></p>
  
  <p><a href="https://i.stack.imgur.com/YFmxc.jpg" rel="nofollow noreferrer">Screen cap of aud param in jwt.ms</a></p>