[Bug] Unable to login with WAM when an app scope is used

[Marko97IT]

Library version used

4.67.1

.NET version

9.0

Scenario

PublicClient - desktop app

Is this a new or an existing app?

This is a new app or experiment

Issue description and reproduction steps

If you try to login with WAM with a scope created by an app it throw an exception.
The exception message is (HResult -2146233088):

WAM Error
Error Code: 0
Error Message: ApiContractViolation
WAM Error Message: Token response failed because declined scopes are present:'(pii)'
Internal Error Code: 593794722
Possible causes:

• Invalid redirect uri - ensure you have configured the following url in the application registration in Azure Portal: ms-appx-web://microsoft.aad.brokerplugin/

Relevant code snippets

var app = PublicClientApplicationBuilder.Create(_clientId)
    .WithAuthority($"https://login.microsoftonline.com/{_tenantId}")
    .WithParentActivityOrWindow(() => windowHandle)
    .WithBroker(new BrokerOptions(BrokerOptions.OperatingSystems.Windows) { Title = "Login account" })
    .WithDefaultRedirectUri()
    .Build();

try
{
    var authenticationResult = await app.AcquireTokenInteractive(_scopes)
        .WithPrompt(Prompt.SelectAccount)
        .ExecuteAsync();
}
catch (MsalException ex)
{
    ...
}

_scopes is an array of string: [ "User.Read", "api://client-id/vpn_access" ]

Expected behavior

No response

Identity provider

Microsoft Entra ID (Work and School accounts and Personal Microsoft accounts)

Regression

No response

Solution and workarounds

Use AcquireTokenInteractive only with User.Read scope to login, then use AcquireTokenSilent with the app scope and passing as second parameter result.Account (result of the first authentication with WAM).
This will work only if the user had already given consent previously or if the tenant administrator has set consent.

[ashok672]

This is expected. The user has to consent or the tenant admin has to set consent.

[Marko97IT]

This is expected. The user has to consent or the tenant admin has to set consent.

Have you read the issue?
I am reporting that I cannot pass an app scope if I use WAM.
Below I explained the workaround. It is obvious that the user must allow, the fact is that since I silently obtain the second token for the app scope, if the user had not previously allowed, the workaround cannot work.

[ashok672]

I did read through the issue. Your silent token call failing with a different scope is expected. You have to go through Interactive flow with new scope so the user can consent for that scope.

[ashok672]

Also refer to this documentation if thats what you need.
https://learn.microsoft.com/en-us/entra/msal/dotnet/acquiring-tokens/desktop-mobile/acquiring-tokens-interactively#withextrascopestoconsent