title: Using Microsoft.Identity.Web RequiredScope to verify the scopes at the level of the controller - Does not verify scope
body: <p>I'm using the eShopOnContainers sample for .NET microservices architecture and have switched to AD B2C instead of IdentityServer4 for microservice authentication.</p>
  <p>Initial set up here:</p>
  <p><a href="https://stackoverflow.com/a/71874003/3850405">https://stackoverflow.com/a/71874003/3850405</a></p>
  <pre><code>builder.Services.AddAuthentication(options =&gt;
  {
      options.DefaultAuthenticateScheme = Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerDefaults.AuthenticationScheme;
      options.DefaultChallengeScheme = Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerDefaults.AuthenticationScheme;
  
  }).AddJwtBearer(options =&gt;
  {
      options.MetadataAddress = $&quot;&lt;iss URL&gt;.well-known/openid-configuration?p=&lt;tfp&gt;&quot;;
      options.Audience = &quot;&lt;aud GUID&gt;&quot;;
  });
  </code></pre>
  <p>This works really well but in the next stage I want to verify that a user has the required scope.</p>
  <p><a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/scenario-protected-web-api-verification-scope-app-roles?tabs=aspnetcore#verify-the-scopes-at-the-level-of-the-controller" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/active-directory/develop/scenario-protected-web-api-verification-scope-app-roles?tabs=aspnetcore#verify-the-scopes-at-the-level-of-the-controller</a></p>
  <p>I then added this to my controller:</p>
  <pre><code>[Authorize]
  [RequiredScope(&quot;read&quot;)]
  </code></pre>
  <p>Verified that my access token has scope read using <a href="https://jwt.io/" rel="nofollow noreferrer">https://jwt.io/</a></p>
  <pre><code>&quot;scp&quot;: &quot;read&quot;,
  </code></pre>
  <p><a href="https://i.stack.imgur.com/qU4BI.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/qU4BI.png" alt="enter image description here" /></a></p>
  <p>If I then make a request like this everything works:</p>
  <pre><code>GET /WeatherForecast HTTP/1.1
  Host: localhost:7148
  Authorization: Bearer &lt;token&gt;
  </code></pre>
  <p><a href="https://i.stack.imgur.com/tloD6.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/tloD6.png" alt="enter image description here" /></a></p>
  <p>However if I change <code>RequiredScope</code> to <code>[RequiredScope(&quot;abc123&quot;)]</code> and use the same token everything will still work. What needs to be added for <code>RequiredScope</code> to work?</p>