I’m implementing the authorization_code flow with AzureAD OIDC for my application in python using MSAL library.

I need to use v1 OAuth2 endpoints in order to require MFA authentication (which doesn’t seem to be availabile in v2.0), so:

https://login.microsoftonline.com/{tenant}/oauth2/

Instead of

https://login.microsoftonline.com/{tenant}/oauth2/v2.0/

Here’s the sample code:

msal_app = ConfidentialClientApplication(
    client_id="xxx",
    client_credential="yyy",
    oidc_authority="https://sts.windows.net/{tenant}",  # Force OAuth2 v1.0
)

...

flow = msal_app.initiate_auth_code_flow(
    scopes=["User.Read"],
    redirect_uri="zzz",
)

# Redirect to: flow["auth_uri"] + "&amr_values=ngcmfa"  # OAuth2 v2.0 does not accept amr_values which requires the MFA authentication

...

payload = msal_app.acquire_token_by_auth_code_flow(flow, dict(request.query_params))

Here’s what the payload contains:

It worked, but the access_token is weird, it does not appear to be a JWT token (which usually begins with ey).

If I try to use it with Microsoft Graph to use the User.Read scope I asked for, it fails:

requests.get(
        "https://graph.microsoft.com/v1.0/me",
        headers={"Authorization": f"Bearer {payload['access_token']}"}
    ).json()

{'error': {'code': 'InvalidAuthenticationToken', 'message': "IDX14100: JWT is not well formed, there are no dots (.).nThe token needs to be in JWS or JWE Compact Serialization Format. (JWS): 'EncodedHeader.EndcodedPayload.EncodedSignature'. (JWE): 'EncodedProtectedHeader.EncodedEncryptedKey.EncodedInitializationVector.EncodedCiphertext.EncodedAuthenticationTag'.", 'innerError': {'date': '2024-06-03T08:58:59', 'request-id': 'qqq', 'client-request-id': 'www'}}}

So question: why is it giving an access_token that cannot be used?

Note: If I switch to OAuth2 v2.0, it works without issues and returns a valid JWT token in access_token, however, I cannot use amr_values to enforce MFA, which is a requirement.

Can you help me understanding what is going on?