为什么SharePoint不接受login.microsoftonline.com的应用专用访问令牌？

我正在开发一个向SharePoint上传文件的脚本，拥有client_id和client_secret，可成功从以下两个端点获取访问令牌：

• https://login.microsoftonline.com/{tenant-id}/oauth2/v2.0/token
• https://accounts.accesscontrol.windows.net/{tenant-id}/tokens/OAuth/2

但SharePoint仅认可来自accounts.accesscontrol.windows.net的访问令牌，我想了解其中原因。使用login.microsoftonline.com的访问令牌会返回如下401错误响应：

status: 401
body: {"error_description": "ID3035: The request was not valid or is malformed."}
headers: {
  "x-cache": "CONFIG_NOCACHE",
  "x-ariacollectorurl": "https://eu-mobile.events.data.microsoft.com/Collector/3.0",
  "x-databoundary": "EU",
  "x-msedge-ref": "Ref A: *** Ref B: *** Ref C: 2024-01-18T08:12:48Z",
  "x-ms-diagnostics": "3001000;reason=\"There has been an error authenticating the request.\";category=\"invalid_client\"",
  "x-ms-invokeapp": "1; RequireReadOnly",
  "x-content-type-options": "nosniff",
  "sprequestduration": "25",
  "content-length": "74",
  "www-authenticate": "Bearer realm=\"d12d11b1-0ad7-4e14-9385-3892b5d6b09a\",client_id=\"00000003-0000-0ff1-ce00-000000000000\",trusted_issuers=\"00000001-0000-0000-c000-000000000000@*,0C538Cfd-6795-4147-9694-1BBC07C2B642@*,https://sts.windows.net/*/,https://login.microsoftonline.com/*/v2.0,00000003-0000-0ff1-ce00-000000000000@53185463-2120-46f2-94ab-4d605a94eb8c\",authorization_uri=\"https://login.microsoftonline.com/common/oauth2/authorize\"",
  "sprequestguid": "dcfc75ba-b65e-4d9e-be2a-59f572d499af",
  "x-networkstatistics": "0,531568,0,0,292231,0,451786",
  "p3p": "CP=\"ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI\"",
  "microsoftsharepointteamservices": "16.0.0.24503",
  "x-1dscollectorurl": "https://eu-mobile.events.data.microsoft.com/OneCollector/1.0/",
  ":status": "401",
  "date": "Thu, 18 Jan 2024 08:12:48 GMT",
  "spiislatency": "3",
  "request-id": "dcfc75ba-b65e-4d9e-be2a-59f572d499af",
  "x-powered-by": "ASP.NET",
  "cache-control": "private",
  "ms-cv": "****"
}

以下是两个令牌提供方的访问令牌负载示例：

login.microsoftonline.com:

{
  "aud": "https://contoso.sharepoint.com",
  "iss": "https://sts.windows.net/d12d11b1-0ad7-4e14-9385-3892b5d6b09a/",
  "iat": 1705647949,
  "nbf": 1705647949,
  "exp": 1705651849,
  "aio": "RnVpdGdH***kdPV2NkNThzYVdjMwo=",
  "app_displayname": "My App",
  "appid": "f3a7cbdc-6abc-48a1-9557-c23228ed7f6b",
  "appidacr": "1",
  "idp": "https://sts.windows.net/d12d11b1-0ad7-4e14-9385-3892b5d6b09a/",
  "idtyp": "app",
  "oid": "36e55927-0f14-4d0d-a4d1-9a06d7188e41",
  "rh": "0.AR1A7***AAAAAAPEPbgAAAAAAAAEFAAA.",
  "sid": "99d2c090-a7fd-447c-a3ce-b552ff45b3d9",
  "sub": "36e55927-0f14-4d0d-a4d1-9a06d7188e41",
  "tid": "d12d11b1-0ad7-4e14-9385-3892b5d6b09a",
  "uti": "2BKsNj***bbovXNpGOAA",
  "ver": "1.0"
}

accounts.accesscontrol.windows.net:

{
  "aud": "00000003-0000-0ff1-ce00-000000000000/contoso.sharepoint.com@d12d11b1-0ad7-4e14-9385-3892b5d6b09a",
  "iss": "00000001-0000-0000-c000-000000000000@d12d11b1-0ad7-4e14-9385-3892b5d6b09a",
  "iat": 1705647949,
  "nbf": 1705647949,
  "exp": 1705651849,
  "identityprovider": "00000001-0000-0000-c000-000000000000@d12d11b1-0ad7-4e14-9385-3892b5d6b09a",
  "nameid": "f3a7cbdc-6abc-48a1-9557-c23228ed7f6b@d12d11b1-0ad7-4e14-9385-3892b5d6b09a",
  "oid": "36e55927-0f14-4d0d-a4d1-9a06d7188e41",
  "sub": "36e55927-0f14-4d0d-a4d1-9a06d7188e41",
  "trustedfordelegation": "false"
}

我认为使用login.microsoftonline.com更合理，因为在线文档通常推荐该端点。

说明： UUID已替换，其他字段已混淆或审查，以保留格式同时隐藏敏感信息。HTTP响应和两个访问令牌中的UUID仍保持匹配。

内容的提问来源于stack exchange，提问作者Jacob