Scopes - any best practices?

[tyf]

Hey @mnj, great question!

@mnj

Usually, when reading about OAuth2, you can find information that the permission should be defined in scopes to state exactly what is needed. I recently looked into how Microsoft does that in their Azure Portal. It turns out that the only scope I get when accessing the portal is “user_impersonation”. Why is that? My guess is that the token would be too big if they included all the permissions as scopes?

Here’s a great blog post of ours that goes into this a bit: On The Nature of OAuth2’s Scopes and another community thread which may prove useful as well.

Hope this helps!