If your scopes laid out in this request span several source server, then the Microsoft identity System returns a token to the source laid out in the main scope. To learn more, see Permissions and consent from the Microsoft identity System.InvalidExternalSecurityChallengeConfiguration - Statements sent by external service provider is just not enough