Microsoft Power Platform OAuth Scopes

generated: '2026-09-06'
method: searched
source: >-
  Derived baseline from openapi/microsoft-power-platform-metadata-api-openapi.yml and
  openapi/microsoft-power-platform-records-api-openapi.yml, then enriched from
  https://learn.microsoft.com/en-us/power-platform/admin/programmability-authentication-v2,
  https://learn.microsoft.com/en-us/power-platform/admin/programmability-permission-reference and
  https://learn.microsoft.com/en-us/power-apps/maker/data-platform/data-platform-mcp-other-clients
  (all HTTP 200, fetched 2026-09-06)
docs: https://learn.microsoft.com/en-us/power-platform/admin/programmability-permission-reference
model: >-
  Power Platform uses resource-scoped Entra ID permissions, not a fine-grained scope catalogue.
  For machine-to-machine access you request the resource's /.default scope and the real
  authorization decision is made by the Dataverse security role or Power Platform admin role
  attached to the principal inside the environment. That is why this list is short and the
  permission reference, not this file, is where the granularity lives.
schemes:
- name: oauth2
  provider: Microsoft Entra ID
  flows:
  - flow: authorizationCode
    authorizationUrl: https://login.microsoftonline.com/common/oauth2/v2.0/authorize
    tokenUrl: https://login.microsoftonline.com/common/oauth2/v2.0/token
  - flow: clientCredentials
    tokenUrl: https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token
- name: azure_auth
  provider: Microsoft Entra ID
  resource: https://management.azure.com
  flows:
  - flow: implicit
    authorizationUrl: https://login.microsoftonline.com/common/oauth2/authorize
scopes:
- scope: https://{org}.api.crm.dynamics.com/.default
  resource: Microsoft Dataverse Web API
  description: >-
    All permissions the calling principal has been granted on that Dataverse environment. Actual
    reach is decided by the security role on the user or application user, not by the scope.
  flows: [authorizationCode, clientCredentials]
- scope: https://{org}.api.crm.dynamics.com/user_impersonation
  resource: Microsoft Dataverse Web API
  description: Delegated access to Dataverse on behalf of the signed-in user.
  flows: [authorizationCode]
- scope: https://api.powerplatform.com/.default
  resource: Power Platform API
  description: >-
    Tenant administration surface. Which namespaces the token can actually reach is governed by
    the Power Platform admin permission reference.
  flows: [authorizationCode, clientCredentials]
- scope: mcp.tools
  resource: Dynamics CRM (Dataverse MCP server)
  description: >-
    Delegated permission that grants an MCP client access to the Dataverse MCP server. Granting
    it is not sufficient on its own - the client's application id must also be added to the
    environment's allowed MCP clients list in the Power Platform admin center.
  flows: [authorizationCode]
- scope: user_impersonation
  resource: https://management.azure.com
  description: >-
    Azure Resource Manager impersonation, declared in Microsoft's Swagger for the
    Microsoft.PowerPlatform provider. Governs enterprise policies, accounts and private link.
  flows: [implicit]
consent:
  tenant_admin_required: true
  note: >-
    A tenant administrator must grant admin consent before a client can authenticate. Microsoft
    publishes the consent URL form
    https://login.microsoftonline.com/{tenant-id}/adminconsent?client_id={client-id} and, for its
    own Dataverse CLI proxy, the app id 0c412cc3-0dd6-449b-987f-05b053db9457.