title: Either scp or roles claim need to be present in the token using when application permissions to read sharepoint sites
body: <p>I created an app in Azure and set it up to use Access and ID tokens. </p>
  
  <p><a href="https://i.stack.imgur.com/DAdL8.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/DAdL8.png" alt="enter image description here"></a></p>
  
  <p>I want to connect to different tenants and read SharePoint sites. Here are the permissions I've requested and received Admin Consent for:</p>
  
  <p><a href="https://i.stack.imgur.com/mJ0EM.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/mJ0EM.png" alt="enter image description here"></a></p>
  
  <p>For now, I have set up an App Secret but I do plan to move to a certificate later. </p>
  
  <p>I have this code to get the access token and I do get an access token back:</p>
  
  <pre class="lang-js prettyprint-override"><code>const params = new URLSearchParams();
  params.append("grant_type", "client_credentials");
  params.append("scope", "https://graph.microsoft.com/.default");
  params.append("client_id", process.env.client_id);
  params.append("client_secret", process.env.client_secret);
  
  var url = `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/token`;
  const response = await fetch(url,
      {
          method: 'POST',
          body: params,
          headers: { 'Content-Type': 'application/x-www-form-urlencoded' }
      }
  );
  </code></pre>
  
  <p>However when I try to read the root site below</p>
  
  <pre class="lang-js prettyprint-override"><code>var url = "https://graph.microsoft.com/v1.0/sites?search=*";
  const response = await fetch(url,
      {
          method: 'GET',
          headers: { 'Authorization': `Bearer ${access_token}` }
      }
  );
  </code></pre>
  
  <p>I get this error:</p>
  
  <pre class="lang-js prettyprint-override"><code>error: { 
      code: 'AccessDenied',
      message: 'Either scp or roles claim need to be present in the token.',
      innerError: { 
          'request-id': 'ec47913f-2624-4d1c-9b27-5baf05ccebfd',
          date: '2019-08-16T14: 15: 37'
      }
  }
  </code></pre>
  
  <p>I checked the token at <a href="https://jwt.io/" rel="nofollow noreferrer">https://jwt.io/</a> and indeed I do not see any entry for <code>roles</code> or <code>scp</code>. </p>
  
  <p>It looks like I missed a step but I cannot figure out which step. </p>
  
  <p>I am getting the token like this:</p>
  
  <pre><code>https://login.microsoftonline.com/${tenant}/oauth2/v2.0/token 
  </code></pre>
  
  <p>What am I doing incorrectly? </p>