Azure AD OAuth2令牌格式无效：EWS访问异常求助

我尝试通过客户端流（Client Flow）进行OAuth2认证以获取访问令牌，代码如下：

var cca = ConfidentialClientApplicationBuilder
                 .Create("client id")
                 .WithTenantId("tenant id")
                 .WithClientSecret("client secret")
                 .Build();

var ewsScopes = new string[] { "https://outlook.office365.com/.default" };

var authResult = await cca.AcquireTokenForClient(ewsScopes).ExecuteAsync();

ExchangeService _service = new ExchangeService();

_service.Url = new Uri("https://outlook.office365.com/EWS/Exchange.asmx");
_service.Credentials = new OAuthCredentials(authResult.AccessToken); 
_service.ImpersonatedUserId = new ImpersonatedUserId(ConnectingIdType.SmtpAddress, crmEmail);

令牌已成功生成，但访问EWS邮箱时出现以下异常：

The format of value 'Bearer eyJ0eXAiOiJKV1QiLCJub25jZSI6Im9RSEFjaS1HWHlyTEprVFZFME5QZ0stXzdpMmpGejg5eXhiY3U2N2g3WXciLCJhbGciOiJSUzI1NiIsIng1dCI6Ii1LSTNROW5OUjdiUm9meG1lWm9YcWJIWkdldyIsImtpZCI6Ii1LSTNROW5OUjdiUm9meG1lWm9YcWJIWkdldyJ9.eyJhdWQiOiJodHRwczovL291dGxvb2sub2ZmaWNlMzY1LmNvbSIsImlzcyI6Imh0dHBzOi8vc3RzLndpbmRvd3MubmV0L2M4YzNkM2FkLTM3MTAtNDEwZC1iZGFhLTQyZDA4NGQ1OTVkNS8iLCJpYXQiOjE2NzE3MTk2OTksIm5iZiI6MTY3MTcxOTY5OSwiZXhwIjoxNjcxNzIzNTk5LCJhaW8iOiJFMlpnWUdqODVCUnUzdmsvZkZmM281a0h3dHA5QVE9PSIsImFwcF9kaXNwbGF5bmFtZSI6IkNSTS1FV1MiLCJhcHBpZCI6IjdlNTQ4MmI4LWMwMDAtNDM4MC04M2YxLWQwMTk4NjNlYTRiYyIsImFwcGlkYWNyIjoiMSIsImlkcCI6Imh0dHBzOi8vc3RzLndpbmRvd3MubmV0L2M4YzNkM2FkLTM3MTAtNDEwZC1iZGFhLTQyZDA4NGQ1OTVkNS8iLCJvaWQiOiJjZWVmYTI0OC1iMGJjLTRlZTMtYmJhZC0xMjZhNmM0NTkyOWUiLCJyaCI6IjAuQVNvQXJkUER5QkEzRFVHOXFrTFFoTldWMVFJQUFBQUFBUEVQemdBQUFBQUFBQUFxQUFBLiIsInJvbGVzIjpbImZ1bGxfYWNjZXNzX2FzX2FwcCJdLCJzaWQiOiI0ZDQ1YTc2NS00ZTk1LTRiM2UtYWEyYy0yNDQ2MGQ2ZWQ1ZDUiLCJzdWIiOiJjZWVmYTI0OC1iMGJjLTRlZTMtYmJhZC0xMjZhNmM0NTkyOWUiLCJ0aWQiOiJjOGMzZDNhZC0zNzEwLTQxMGQtYmRhYS00MmQwODRkNTk1ZDUiLCJ1dGkiOiJPcm5WejMwQUswaVctV2hMTVI3dEFBIiwidmVyIjoiMS4wIiwid2lkcyI6WyIwOTk3YTFkMC0wZDFkLTRhY2ItYjQwOC1kNWNhNzMxMjFlOTAiXX0.rSoLFZ8uu1Nyf3utEfbaLU_dWHUXaVwKtqDNlVgisNvLaFVvkmMAGYkuanmUoWL2PFKvKXEBspFzJsX_qO02a20xCIDKZI9_CjJicDcg36CxAolCFqt50VXhhm5ebVjh9cWWeYP9DFV028VGUJRhJ7hYM8Uusmk9kuXka6pKW7SpZ0fNT_SY14sceT5RvVW3Zi1DkO0lm_6btuXolqIHXUTvbrFPN7kt-_DiOBn6oZUb-sPoWUditRGTOe_AZ-f5tKubVGcxqMPXCUs82CYxKVoXrEqJb5ISXCLHzg-TS6xbc8N1UEBAqpaLvqlYqAiclzRDBTHDgC8ob1DIxqtp9Q' is invalid.

解决建议 #

• 移除Bearer前缀：OAuthCredentials构造函数仅需传入纯JWT令牌字符串，不需要手动添加Bearer 前缀。错误信息显示令牌值包含该前缀，这是格式错误的核心原因。直接使用authResult.AccessToken即可，无需拼接。
• 确认应用权限配置：在Azure AD中为应用添加EWS的full_access_as_app应用权限，并确保已获得管理员同意。客户端流需要应用级权限，权限未正确配置会导致令牌无法被EWS服务认可。
• 验证令牌受众：解码令牌查看aud字段，确认其值为https://outlook.office365.com，确保令牌是针对EWS服务颁发的。
• 检查EWS服务URL：如果是中国区租户，需将EWS URL替换为https://partner.outlook.cn/EWS/Exchange.asmx，确保URL与租户区域匹配。

内容的提问来源于stack exchange，提问作者Chee Mun