Let the printer see one album

Steps

1. Approve a single scope for the demo client.

   What the server will check: Your tenant recorded a grant with that scope.

2. Call the lab API with the access token.

   What the server will check: The API allowed the request you granted.

3. Try an operation that needs a scope you did not grant.

   What the server will check: The API rejected it.

   The token carries only the access you approved, whatever the client asks for later.

When it opens

This lab is planned. It opens when these are in place:

• Lab setup and cleanup in your test tenant
• The demo client application
• A lab resource API

The server checks your test tenant's history for this attempt. You can review the events yourself in your tenant's Audit and Logs.

Learn the theory

• Giving another application limited accessSharing access without a password
• Giving another application limited accessFollowing the permission
• Giving another application limited accessUsing limited access
• The problem OAuth solvesDelegated access