title: SharePoint API: Can't authenticate 'Sites.FullControl.All' in client_credential flow
body: <p>I've have an App that would like to access SharePoint API.
  I've registered it in AD, and gave it the following permissions:</p>
  
  <p><a href="https://i.stack.imgur.com/5WkRq.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/5WkRq.png" alt="enter image description here"></a></p>
  
  <p>But when I ask it to be authenticated with the following scopes</p>
  
  <pre><code>    - https://graph.microsoft.com/User.Read.All
      - https://graph.microsoft.com/Group.Read.All
      - https://graph.microsoft.com/Sites.Read.All
      - https://graph.microsoft.com/Calendars.Read.Shared
      - https://graph.microsoft.com/MailboxSettings.Read
      - https://graph.microsoft.com/Files.Read.All
      - https://graph.microsoft.com/Directory.Read.All
      - https://graph.microsoft.com/AuditLog.Read.All
      - https://graph.microsoft.com/AuditLog.Read.All
      - offline_access
      - https://manage.office.com/ActivityFeed.Read
      - https://microsoft.sharepoint-df.com/Sites.FullControl.All
      - https://microsoft.sharepoint-df.com/Sites.Read.All
      - https://microsoft.sharepoint-df.com/User.Read.All
  </code></pre>
  
  <p>I get this error:</p>
  
  <pre><code>invalid_client&amp;error_description=AADSTS650053: 
  enter code here`The application 'XXX' asked for scope
  'Sites.FullControl.All' that doesn't exist on the resource
  '00000003-0000-0ff1-ce00-000000000000'. 
  Contact the app vendor.
  </code></pre>
  
  <p>What does this mean that it <code>that doesn't exist on the resource</code>?
  With all the other scopes (except SharePoint's) it all works fine</p>