I am using the following endpoint to fetch an access token to use Graph API for B2C user management:
https://<b2cTenant>.b2clogin.com/<b2cTenant>.onmicrosoft.com/<b2cPolicy>/oauth2/v2.0/token
In the body of the POST I am sending
grant_type: client_credentials
client_id: The client id of an B2C registered app. I used the API Permissions tab to grant access to various Graph API operations
client_secret: <secret>
scope: https://graph.microsoft.com/.default
In the response I am getting:
{ "error": "invalid_grant", "error_description": "AADB2C90085: The service has encountered an internal error. Please reauthenticate and try again.\r\nCorrelation ID: <correlationId>\r\nTimestamp: 2022-10-31 16:49:08Z\r\n" }
I found samples to authenticate for B2C Graph access, but they reference an AAD authority url. I don't understand how an access token retrieved from an AAD tenant (e.g. https://login.microsoftonline.com/${process.env.TENANT_ID}) will help in performing operations on a B2C tenant.
See: https://github.com/Azure-Samples/ms-identity-b2c-javascript-nodejs-management/blob/main/Chapter2/bin/authConfig.js#L4
When I plug the B2C tenant value into the AAD authority URL I predictably get the following error:
AADSTS900023: Specified tenant identifier '<my b2c tenant>' is neither a valid DNS name, nor a valid external domain