If your scopes laid out in this request span numerous resource server, then the Microsoft id System returns a token for that source specified in the 1st scope. For more information, see Permissions and consent during the Microsoft identity platform. InvalidExternalSecurityChallengeConfiguration -