When the scopes laid out in this ask for span several resource server, then the Microsoft id platform returns a token with the source laid out in the primary scope. To learn more, see Permissions and consent in the Microsoft id platform. InvalidExternalSecurityChallengeConfiguration - Promises de