Access token
An access token is a credential a client presents to a resource server to request an operation within the access it was granted.
What the API receives
An application calling a protected service, such as Microsoft Graph, sends an access token with its request. The service checks the token and decides whether to allow the operation. This can be access on behalf of a signed-in user or access granted to the application itself.
The token has limits: which resource it is for, what access it grants, and how long it is valid. A token that works with one API will not necessarily work with another.
Access token, refresh token, or ID token?
Each has a different job:
- Access token: lets the client request an operation from a resource.
- Refresh token: lets the client request another access token from the authorization server.
- ID token: tells the client about the user’s authentication.
An ID token is not an API access token. A refresh token goes back to the authorization server, not to the API.
Can the application read the token?
Some access tokens are JWTs, but clients should treat access tokens as opaque credentials. An application should not rely on decoding a token meant for another service. That service is responsible for validating the tokens it accepts.
During an investigation, look for what happened at the resource as well as at sign-in. A successful sign-in does not tell you whether anyone read a mailbox. Check the operation’s result, and keep live tokens out of reports.