title: Scope is not being added to Access Token returned from Azure Ad
body: <p><strong>Overview</strong></p>
  <p>We have an Azure AD secured API living in Azure as a web app. We need to be able to:</p>
  <ol>
  <li>Trigger this API via user interaction from a client application (this part works).</li>
  <li>Trigger this API programmatically from a scheduled job that will simply get a token &amp; hit this API (this part does not work due to authentication issues).</li>
  </ol>
  <p><strong>Problem</strong></p>
  <p>The issue is that when we request a token from Azure AD, scope is not being set in our token claims resulting in the API rejecting the token.</p>
  <p>This is the request we are making:
  <a href="https://i.stack.imgur.com/OuTul.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/OuTul.png" alt="enter image description here" /></a></p>
  <p>This request returns an access token with the following claims:</p>
  <pre><code>{
    &quot;aud&quot;: &quot;&lt;our api client id&gt;&quot;,
    &quot;iss&quot;: &quot;https://login.microsoftonline.com/&lt;tenantId&gt;/v2.0&quot;,
    &quot;iat&quot;: 1644421512,
    &quot;nbf&quot;: 1644421512,
    &quot;exp&quot;: 1644425412,
    &quot;aio&quot;: &quot;&lt;value&gt;&quot;,
    &quot;azp&quot;: &quot;&lt;scheduled job client id&gt;&quot;,
    &quot;azpacr&quot;: &quot;1&quot;,
    &quot;oid&quot;: &quot;&lt;guid&gt;&quot;,
    &quot;rh&quot;: &quot;&lt;value&gt;&quot;,
    &quot;sub&quot;: &quot;&lt;guid&gt;&quot;,
    &quot;tid&quot;: &quot;&lt;guid&gt;&quot;,
    &quot;uti&quot;: &quot;&lt;value&gt;&quot;,
    &quot;ver&quot;: &quot;2.0&quot;
  }
  </code></pre>
  <p>As you can see <code>scp</code> (scope) is not included in the token claims even though we include it in the request.</p>
  <p>If we use this token to make a request to our API we get the following error:</p>
  <pre><code>System.UnauthorizedAccessException: IDW10201: Neither scope or roles claim was found in the bearer token.
  </code></pre>
  <p>Any help on how we can get an access token from Azure AD with the proper scope/permissions to call our API, would be greatly appreciated.</p>
  <p><strong>Note</strong></p>
  <p>The Azure AD App Registration for our scheduled job that will request a token and then hit our API, does have the Delegated API Permission <code>access_as_user</code> which you can see I am including in the token request's scope.</p>