When the scopes laid out in this request span many useful resource server, then the Microsoft identity System returns a token for that source laid out in the very first scope. For more info, see Permissions and consent in the Microsoft id System.InvalidExternalSecurityChallengeConfiguration - Claims sent by exterior provider isn't sufficient or Mis