Power Platform Community Forum Thread Details

Thank you for your support.
I have a question about integrating a Power Automate Custom Connector with the Microsoft Graph API.

What I want to achieve

I would like to pass an Entra ID access token obtained via a Power Automate custom connector to my custom API, and then use that token to call Microsoft Graph API (mainly to retrieve documents from SharePoint).

Architecture / Flow

I implemented the solution with the following flow:

Perform OAuth 2.0 authentication in Power Automate (Custom Connector)
Obtain an access token (JWT) from Entra ID
Send a request from the custom connector to my custom API (via APIM) with:
・Authorization: Bearer {access token}
・API Key
In the custom API, use the received token to call Microsoft Graph API

Issue

When calling Microsoft Graph API from the custom API, the following error occurs:

{
  "error": {
    "code": "InvalidAuthenticationToken",
    "message": "Access token validation failure. Invalid audience."
  }
}

Investigation

After inspecting the access token issued for the custom connector, I confirmed the audience (aud) claim is:

- "https://apihub.azure.com"

On the other hand, I understand Microsoft Graph requires the following audience:

- "https://graph.microsoft.com"

Therefore, I believe the authentication error is caused by an audience mismatch.

Current understanding

I think the token obtained by the Power Automate custom connector is intended for the Power Platform execution infrastructure (apihub), and cannot be used directly with Microsoft Graph API.

Questions

I would appreciate your guidance on the following:

① Recommended architecture

For this scenario (Custom Connector → Custom API → Graph), what is the Microsoft-recommended implementation pattern?
Examples:

Having the custom API acquire a separate access token for Graph
Using the On-behalf-of (OBO) flow, etc.

② Token acquisition via custom connector

Using only OAuth authentication in a Power Automate custom connector, is it possible to obtain an access token whose audience is Microsoft Graph (https://graph.microsoft.com)?