title: Azure AD issuing token that contains scopes I disabled
body: <p>I'm trying to use Azure AD to restrict access to certain endpoints in my API. </p>
  
  <p>I registered a FrontEnd and API app in Azure AD. When I go to disable the scopes I'm still getting the scopes issued in my oauth token. </p>
  
  <p><img src="https://i.stack.imgur.com/80K3m.png" alt="FrontEnd-Scope"></p>
  
  <p><img src="https://i.stack.imgur.com/KUYuo.png" alt="Oauth-token"></p>
  
  <p>Anyone have any ideas what I may be missing?</p>
  
  <p>Thanks!</p>