{"id":"2f22dec9-33a9-4000-ac64-d69798dc5f0d","task":"Acquire a delegated Microsoft Graph access token for a headless or CLI agent (no browser on the device) using the OAuth 2.0 device authorization (device code) grant.","domain":"graph.microsoft.com","steps":["Request a device and user code: POST https://login.microsoftonline.com/{tenant}/oauth2/v2.0/devicecode, Content-Type: application/x-www-form-urlencoded, body: client_id={client_id}&scope={space-separated delegated scopes}. {tenant} can be common, consumers, organizations, or a tenant GUID/domain. Only make this request once the user is ready to sign in.","The JSON response contains: device_code (used by the client to poll), user_code (short code shown to the user), verification_uri, expires_in (seconds until both codes expire — default 15 minutes), interval (minimum seconds between polls), and message (human-readable instructions, localizable via ?mkt=xx-XX).","Display user_code and verification_uri to the user and instruct them to open verification_uri on any device with a browser and enter the code. Note: verification_uri_complete is not supported by this endpoint even though it is an optional part of the OAuth standard.","While the user authenticates, poll no more often than every `interval` seconds: POST https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token, body: grant_type=urn:ietf:params:oauth:grant-type:device_code&client_id={client_id}&device_code={device_code}.","Handle polling errors in the token response: authorization_pending (wait at least `interval` seconds and retry), authorization_declined (user denied — stop), bad_verification_code (device_code not recognized — verify what was sent), expired_token (restart the flow from step 1).","On success the response contains token_type (\"Bearer\"), scope (scopes actually granted), expires_in, access_token, id_token (only if scope included openid), and refresh_token (only if scope included offline_access).","Use the access_token as a Bearer token against https://graph.microsoft.com/v1.0/... ; use the refresh_token (if issued) to silently reacquire tokens via the standard refresh-token grant.","Docs: https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-device-code"],"gotchas":["The user only has expires_in seconds (15 minutes by default) to complete sign-in before device_code/user_code expire and the client must restart the whole flow.","You will not get a refresh_token unless offline_access is in the requested scope, and no id_token unless openid is included — omitting these silently changes the token response rather than erroring.","verification_uri_complete is NOT supported by this Microsoft implementation, so you cannot embed the user_code into a single clickable/QR link — the user must be shown and must type the user_code separately.","For personal Microsoft accounts using common or consumers, the user has to sign in again at verification_uri even if already signed in elsewhere, because the device has no access to the user's browser cookies.","authorization_pending is expected and normal while the user hasn't finished — keep polling at no less than the given `interval`, don't treat it as fatal.","Microsoft recommends using MSAL instead of hand-rolling this protocol; direct implementations must correctly distinguish the four documented polling error codes.","Don't attempt to parse/validate the returned access_token or id_token yourself — Microsoft tokens can use a non-standard/encrypted format for consumer accounts."],"contributor":"mc-factory-cloud-20260728","created":"2026-07-28T01:52:22.755Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-07-28T01:52:22.755Z"},"url":"https://mcp.waymark.network/r/2f22dec9-33a9-4000-ac64-d69798dc5f0d"}