Error: "Fails to acquire token" due to "invalid scope"" when attempting to implement Modern Authentication for IOP discovery tool via REST API calls

Products

• VMware vCenter Server
• VMware Cloud Foundation

Issue/Introduction

• Changed authentication/identity source from ADFS to Entra ID with SCIM

• PowerCLI code similar to the following:

$octx = New-OAuthSecurityContext `

-TokenEndpointUrl https://login.microsoftonline.com/########-####-####-####-############/oauth2/token `

-AuthorizationEndpointUrl https://login.microsoftonline.com/########-####-####-####-############/oauth2/authorize `

-RedirectUrl http://localhost:8844/auth `

-ClientId "" `

-ClientSecret "" `

-DisablePKCE `

-OtherArguments @{ "resource" = "" } `

-IgnoreSslValidationErrors

$sctx = New-VISamlSecurityContext `

-VCenterServer "" `

-OAuthSecurityContext $octx `

-IgnoreSslValidationErrors

Connect-VIServer "" -SamlSecurityContext $sctx

• Token response returnes error similar to the following:

$tokenResponse = Invoke-RestMethod -Method POST `
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
{   "error": "invalid_scope",   "error_description": "<hostname>: The provided value for scope openid, profile, email, groups, offline_access is not valid. Client credential flows must have a scope value with /.default suffixed to the resource identifier (application ID URI). Trace ID: ########-####-####-####-############ Correlation ID: ########-####-####-####-############ Timestamp: YYYY-MM-DD hh:mm:ssZ",   "error_codes": [     1002012   ],   "timestamp": "YYYY-MM-DD hh:mm:ssZ",   "trace_id": "########-####-####-####-############",   "correlation_id": "########-####-####-####-############" }
❌ Failed to acquire token.

Environment

vCenter: 8.0U3

VCF: 5.2.0

Cause

Resource identifier requires /.default suffix

Resolution

• resource identifier in -OtherArguments should be:
  -OtherArguments @{ "resource" = "/.default" } `