title: Cant request OAuth2 token for specific scope with Azure AD and Client Credentials flow
body: <p>We are developing an application with a frontend and a backend. The backend should be accessed via Rest API with an OAuth2 token. Authorization provider is Azure AD.</p>
  <p>In Azure we created 2 app registrations. One for the API, one for the client app. The API registration defines 3 scopes (Read, Write, Delete). The client app registration has delegated permission for these scopes.</p>
  <p>We are requesting tokens with the clientID and clientSecret from the client app registration.</p>
  <p>The problem is that we can only request tokens with scope api/.default. E.g. api/read results in invalid scope error.
  But if we use api/.default, no scope (scp) attribute is included in the token. Isn't that needed to check if the app consuming the API has the right permissions?</p>
  <p>I am not sure if we are doing something wrong or if we have a wrong understanding/expectation.</p>