generating common access token for MS graph api and custom api

I have an Angular app and Python REST API server. I have created 2 Azure AD apps for authentication - one SPA Azure Ad app and another Webapi Azure AD app. I have exposed an API from Azure AD app api:///Files.Read. I am using msal v3.

The authentication works fine now I have to implement authorisation. Therefore, I have defined the roles in Webapi Azure AD app and in this app itself I am managing the assignment of the roles to the users. I want the role information in the Angular app to show role based views/screens/interfaces. For getting information of roles, I am relying on Microsoft graph API as I do not want to store and access the access token from local storage and session storage.

How can I generate an access token which can commonly be used for accessing roles from Graph API and my Python API server? Is it even possible to have a common access token? If yes, How should the configuration be done in the msal config such that the access token is generated for both the audiences - graph api and python api?

Continue reading...