Access Token Issuer from Azure AD is sts.windows.net Instead Of login.microsoftonline.com

TL;DR

[juunas (accepted answer)] (Update 2025): The property is now named requestedAccessTokenVersion in the new "Microsoft Graph App Manifest". https://learn.microsoft.com/en-us/entra/identity-platform/azure-active-directory-graph-app-manifest-deprecation#attribute-differences-between-azure-ad-graph-and-microsoft-graph-formats.

Steps

1. [juunas (accepted answer)] (Update 2025): The property is now named requestedAccessTokenVersion in the new "Microsoft Graph App Manifest". https://learn.microsoft.com/en-us/entra/identity-platform/azure-active-directory-graph-app-manifest-deprecation#attribute-differences-between-azure-ad-graph-and-microsoft-graph-formats. The default value is still null and needs to be changed to 2. Original Answer: So seems that changing the acceptedTokenVersion to 2 in the manifest did change but it just took time to take effect. And yes the audience is always the client id based on my tests in v2 tokens.

When to use

You are seeing this: And yes the audience is always the client id based on my tests in v2 tokens. Use this skill when you run into "Access Token Issuer from Azure AD is sts.windows.net Instead Of login.microsoftonline.com".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

Versions mentioned in the source: guid v2.0. If you are on something much newer or older, the details may have shifted.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Sources

• https://learn.microsoft.com/en-us/entra/identity-platform/azure-active-directory-graph-app-manifest-deprecation#attribute-differences-between-azure-ad-graph-and-microsoft-graph-formats
• https://login.microsoftonline.com/{{my
• https://sts.windows.net//{{my
• https://login.microsoftonline.com/
• https://github.com/AzureAD/microsoft-authentication-library-for-js/issues/560

Source: Stack Overflow #59790209 (accepted answer, 52 votes, 6 answers): I'm trying to validate an access token obtained from azure active directory. I obtained the token from https://login.microsoftonline.com/{{my tenant guid}}/v2.0 The issuer in the token that comes back is https://sts.windows.net//{{my tenant guid}}/ which doesn't match. If I check that config at .well-known/openid-configuration the issuer is as expected https://login.microsoftonline.com/.... I've found a similar issue reported on git hub here https://github.com/AzureAD/microsoft-authentication-library-for-js/issues/560 The advice is to manually edit the manifest's json in the applicatio

Verified resolution: [juunas (accepted answer)] (Update 2025): The property is now named requestedAccessTokenVersion in the new "Microsoft Graph App Manifest". https://learn.microsoft.com/en-us/entra/identity-platform/azure-active-directory-graph-app-manifest-deprecation#attribute-differences-between-azure-ad-graph-and-microsoft-graph-formats. The default value is still null and needs to be changed to 2. Original Answer: So seems that changing the acceptedTokenVersion to 2 in the manifest did change but it just took time to take effect. And yes the audience is always the client id based on my tests in v2 tokens.

Source URL: https://stackoverflow.com/questions/59790209