I develop a Teams app for web and desktop. The app works perfectly with Teams Web but fails on Teams Desktop. Teams Desktop is hard to debug.
My investigation yielded that Teams Web allows to acquire all scopes at once while Teams Desktop needs to acquire a minimal user scope first before acquiring all other scopes. I noticed this difference in a previous app where I handcrafted the msal interaction so that it did work on both.
I believe that teams.ts should handle these subtle differences but I did not find a way to hijack the msal interaction inside teams.ts.
(Teams Desktop is hard to debug. Is there a developer tools like edge browser developer tools for Teams Desktop? There is some chance I did setup something wrong but I have evidence that Desktop and Web behave somewhat differently when acquirimg tokens.)
import * as client from '@microsoft/teams.client';
import * as teamsJs from '@microsoft/teams-js';
export default function App() {
const [app, setApp] = React.useState(null);
React.useEffect(() => {
// initialize the app and prompt for Graph scope consent, if not already granted
const app = new client.App(msalConfig.auth.clientId, { // My app registation client id
logger: new ConsoleLogger('@RdpDashboard/tab', { level: 'debug' }),
msalOptions: {
prewarmScopes: scopes // ["User.Read", "Files.ReadWrite.All", "Group.Read.All", "ChannelMessage.Read.All", "ChannelMessage.Send"]
}
});
teamsJs.app.initialize().then(() => {
app.start().then(async () => {
const has_scopes = await app.ensureConsentForScopes() // FAILS
if (has_scopes) {
teamsJs.app.notifySuccess();
setApp(app);
} else {
setContent("Could not acquire needed permissions: " + scopes.join(", "))
}
}).catch(console.error);
})
}, []);
return (<div>my app content</div>)
}
I expect that in Teams Desktop a token is acquired and Microsoft Graph can be successfully accessed like in Teams Web.
Uncaught runtime errors:
ERROR
ApiContractViolation: ApiContractViolation {"Description":"Token response failed because declined scopes are present:'(pii)'","Domain":"com.microsoft.oneauth","ErrorCode":"2206","Message":"The passed in target value is invalid. Some of the scopes (targets) are declined by the server.","SubStatus":"6401","SystemErrorCode":"0","Tag":"9zj08","Type":"OneAuth","additional_query_parameters_count":"4","all_error_tags":"9zj08|9zj08","api_error_code":"0","api_error_context":"Token response failed because declined scopes are present:'(pii)'","api_error_tag":"9zj08","api_name":"AcquireTokenSilently","api_status_code":"StatusInternal::ApiContractViolation","auth_flow":"Broker","authority_type":"AAD","authorization_type":"WindowsIntegratedAuth","broker_app_used":"true","client_id":"1fec8e78-bce4-4aaf-ab1b-5451cc387264","correlation_id":"019eae57-bc35-79be-b5f9-c52f21d15715","is_successful":"false","msal_version":"9.0.0","nested_client_id":"1e92eadc-ef24-4a63-8ab8-6c0c3d7733c9","original_authority":"https://login.microsoftonline.com/abcdef12-6687-4e73-83d9-eab5527879a9","read_token":"ID","request_duration":"23","request_eligible_for_broker":"true","start_time":"2026-06-09T21:44:05.000Z","stop_time":"2026-06-09T21:44:05.000Z","storage_read":"DAC|DID|DAC","storage_write":"DAT|DID|DAC","tenant_id":"abcdef12-6687-4e73-83d9-eab5527879a9","wam_telemetry":"{\"x_ms_clitelem\":\"1,0,0,505.9974,\",\"ui_visible\":false,\"tenant_id\":\"abcedf12-6687-4e73-83d9-eab5527879a9\",\"scope\":\".default offline_access openid profile\",\"redirect_uri\":\"ms-appx-web://Microsoft.AAD.BrokerPlugin/1fec8e78-bce4-4aaf-ab1b-5451cc387264\",\"provider_id\":\"https://login.windows.net\",\"is_guest_user_logon_token_request\":false,\"is_guest_user_logon_session\":false,\"is_guest_resource_scenario\":false,\"http_status\":200,\"http_event_count\":1,\"http_content_type\":\"application/jose; charset=utf-8\",\"http_content_size\":13134,\"device_join\":\"not_joined\",\"correlation_id\":\"{019eae55-4777-7a97-89ad-c3d6ce263c07}\",\"client_id\":\"1fec8e78-bce4-4aaf-ab1b-5451cc387264\",\"ccs_failover_v2\":\"1.P\",\"cache_event_count\":0,\"broker_version\":\"10.0.26100.8457\",\"authority\":\"https://login.microsoftonline.com/abcedf12-6687-4e73-83d9-eab5527879a9\",\"api_error_code\":0,\"account_join_on_start\":\"secondary\",\"account_join_on_end\":\"secondary\",\"account_id\":\"67f64eba-2ea6-41ca-8584-fff71ba5b644\",\"silent_code\":0,\"silent_bi_sub_code\":0,\"silent_message\":\"\",\"silent_status\":0,\"is_cached\":1}","was_request_throttled":"false","write_token":"AT|ID"}
AuthError: ApiContractViolation: ApiContractViolation {"Description":"Token response failed because declined scopes are present:'(pii)'","Domain":"com.microsoft.oneauth","ErrorCode":"2206","Message":"The passed in target value is invalid. Some of the scopes (targets) are declined by the server.","SubStatus":"6401","SystemErrorCode":"0","Tag":"9zj08","Type":"OneAuth","additional_query_parameters_count":"4","all_error_tags":"9zj08|9zj08","api_error_code":"0","api_error_context":"Token response failed because declined scopes are present:'(pii)'","api_error_tag":"9zj08","api_name":"AcquireTokenSilently","api_status_code":"StatusInternal::ApiContractViolation","auth_flow":"Broker","authority_type":"AAD","authorization_type":"WindowsIntegratedAuth","broker_app_used":"true","client_id":"1fec8e78-bce4-4aaf-ab1b-5451cc387264","correlation_id":"019eae57-bc35-79be-b5f9-c52f21d15715","is_successful":"false","msal_version":"9.0.0","nested_client_id":"1e92eadc-ef24-4a63-8ab8-6c0c3d7733c9","original_authority":"https://login.microsoftonline.com/abcdef12-6687-4e73-83d9-eab5527879a9","read_token":"ID","request_duration":"23","request_eligible_for_broker":"true","start_time":"2026-06-09T21:44:05.000Z","stop_time":"2026-06-09T21:44:05.000Z","storage_read":"DAC|DID|DAC","storage_write":"DAT|DID|DAC","tenant_id":"abcdef12-6687-4e73-83d9-eab5527879a9","wam_telemetry":"{\"x_ms_clitelem\":\"1,0,0,505.9974,\",\"ui_visible\":false,\"tenant_id\":\"abcedf12-6687-4e73-83d9-eab5527879a9\",\"scope\":\".default offline_access openid profile\",\"redirect_uri\":\"ms-appx-web://Microsoft.AAD.BrokerPlugin/1fec8e78-bce4-4aaf-ab1b-5451cc387264\",\"provider_id\":\"https://login.windows.net\",\"is_guest_user_logon_token_request\":false,\"is_guest_user_logon_session\":false,\"is_guest_resource_scenario\":false,\"http_status\":200,\"http_event_count\":1,\"http_content_type\":\"application/jose; charset=utf-8\",\"http_content_size\":13134,\"device_join\":\"not_joined\",\"correlation_id\":\"{019eae55-4777-7a97-89ad-c3d6ce263c07}\",\"client_id\":\"1fec8e78-bce4-4aaf-ab1b-5451cc387264\",\"ccs_failover_v2\":\"1.P\",\"cache_event_count\":0,\"broker_version\":\"10.0.26100.8457\",\"authority\":\"https://login.microsoftonline.com/abcedf12-6687-4e73-83d9-eab5527879a9\",\"api_error_code\":0,\"account_join_on_start\":\"secondary\",\"account_join_on_end\":\"secondary\",\"account_id\":\"67f64eba-2ea6-41ca-8584-fff71ba5b644\",\"silent_code\":0,\"silent_bi_sub_code\":0,\"silent_message\":\"\",\"silent_status\":0,\"is_cached\":1}","was_request_throttled":"false","write_token":"AT|ID"}
at NestedAppAuthAdapter.fromBridgeError (https://localhost:3000/static/js/bundle.js:136275:18)
at NestedAppAuthController.acquireTokenSilentInternal (https://localhost:3000/static/js/bundle.js:129490:132)
at async acquireMsalAccessToken (https://localhost:3000/static/js/bundle.js:125148:22)
at async Object.graphRequestAccessTokenInterceptor [as request] (https://localhost:3000/static/js/bundle.js:125056:27)
at async Axios.request (https://localhost:3000/static/js/bundle.js:198591:14)
at async C.call (https://localhost:3000/static/js/bundle.js:177423:21)
at async my_app_read_folder (https://localhost:3000/static/js/bundle.js:560:24)
at async my_app_update_full_state (https://localhost:3000/static/js/bundle.js:683:23)
at async https://localhost:3000/static/js/bundle.js:707:19
Can I expect that teams.ts should work inside Teams Desktop or is that not the scope of this project?
Bug Description
I develop a Teams app for web and desktop. The app works perfectly with Teams Web but fails on Teams Desktop. Teams Desktop is hard to debug.
My investigation yielded that Teams Web allows to acquire all scopes at once while Teams Desktop needs to acquire a minimal user scope first before acquiring all other scopes. I noticed this difference in a previous app where I handcrafted the msal interaction so that it did work on both.
I believe that teams.ts should handle these subtle differences but I did not find a way to hijack the msal interaction inside teams.ts.
(Teams Desktop is hard to debug. Is there a developer tools like edge browser developer tools for Teams Desktop? There is some chance I did setup something wrong but I have evidence that Desktop and Web behave somewhat differently when acquirimg tokens.)
Steps to Reproduce
Expected Behavior
I expect that in Teams Desktop a token is acquired and Microsoft Graph can be successfully accessed like in Teams Web.
Actual Behavior
In Teams Desktop the token could not be acquired, An error is shown:
SDK Version
2.0.11
Node.js Version
22.16.0
Additional Context
Can I expect that teams.ts should work inside Teams Desktop or is that not the scope of this project?