We need to generate an AAD access token which can be used for a client to query Azure Monitor metrics (though Fluent API) for a specific subscription. So the requirements are:
1. the token can only be used to query metrics for a specific subscription, but no others
2. only can query metrics from Azure Monitoring (through ARM I believe)

How can we:
1. obtain the access token?
2. For Azure Management Fluent SDK, how to use the token directly?

Thanks!