SharePoint Access token has two different scope values for tenants

Question

when I decode SharePoint access token for Tenant A and B it shows as below
for the tenant A

"scp": "AllSites.FullControl User.Read User.ReadBasic.All" 

for the tenant B

"scp": ".1f7f4061-caa1-44c4-b29a-6d877e9a5211"   

are there any possible reasons to this kind of result for different tenants where i am expecting Teanat A result.

my token request call is similar to this

                { "grant_type", "authorization_code" },
                 { "client_id", azureConfig.ClientId },
                 { "client_secret", azureConfig.ClientSecret },
                 { "scope", "https://123435350365.sharepoint.com/.default"},
                 { "redirect_uri","url" },
                 { "code", code }

Answer 1

I tried to reproduce the same in my environment and got the scopes successfully in both tenants.

I used the below parameters for both the tenants and got the access token for SharePoint successfully:

After decoding the token, I got the scope for both tenants successfully like below:

• Please check the scope you are giving for Tenant B and verify whether your tenant has access to SharePoint API or not.
• After decoding the token for Tenant B please check the aud and iss claims are valid or not.
• Please note that value for the SharePoint Online Tenant Id may vary for each Tenant.
• Make sure if you are giving permissions for Microsoft Graph then change the scope to https://graph.microsoft.com/.default.

If still the issue persists, try to raise Azure Support Ticket.

You can refer the below links to get some pointer to resolve the issue:

azure - SharePoint online OAuth2 token invalid_scope - Stack Overflow

How to access SharePoint Online data using Postman - REST API and Bearer token