title: Scopes Not Returned w/ Client Credential Flow
body: <p>Can I define custom scope(s) and have them returned when using the <a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow" rel="nofollow noreferrer">client credential flow</a> in Azure AD?</p>
  <hr />
  <p>In my experiment, I configured 2 Azure AD applications, one for a Web API and one for a client (Web API Client A).  I added a scope to the Web API but when requesting the access token via the <a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow" rel="nofollow noreferrer">client credential flow</a>, <strong>the scope wasn’t returned</strong>. </p>
  <p>Also, it only allowed me to request an access token when using <code>.default</code> for a scope, i.e. <code>api://web-api-client-credential-flow/.default</code>.</p>
  <p><a href="https://i.stack.imgur.com/sJsOb.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/sJsOb.png" alt="scopes screenshot" /></a></p>
  <p><a href="https://i.stack.imgur.com/KPFrx.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/KPFrx.png" alt="web api client a api permissions" /></a></p>
  <p>I ran across this Azure Feedback item: <a href="https://feedback.azure.com/d365community/idea/5d5d6b98-c825-ec11-b6e6-000d3a4f0789" rel="nofollow noreferrer">V2.0 Client Credentials Implement Scopes</a> so it appears scopes aren't supported in Azure AD under the client credential flow?</p>
  <p>What’s the point in giving my Web API Client A application permissions for that scope if they are not returned?  How could the Web API know if the daemon application has that scope to perform the necessary action?</p>
  <p>It would seem I would have to use <a href="https://joonasw.net/view/defining-permissions-and-roles-in-aad" rel="nofollow noreferrer">application permissions</a>?</p>