title: Access token validation fails if scope is graph.microsoft.com
body: <p>Received access token from AAD, using below url
  <a href="https://login.microsoftonline.com/gdfdddddd-87dd-497c-b894-xxxxxx/oauth2/v2.0/token" rel="nofollow noreferrer">https://login.microsoftonline.com/gdfdddddd-87dd-497c-b894-xxxxxx/oauth2/v2.0/token</a></p>
  
  <p>grant_type :client_credentials</p>
  
  <p>client_id :xxxxx-1ff5-4615-8d71-yyyyyy</p>
  
  <p>client_secret:[7aCw]fdsfsfsfds.AC61Fg:cm33</p>
  
  <p><strong><em>scope : <a href="https://vault.azure.net/.default" rel="nofollow noreferrer">https://vault.azure.net/.default</a></em></strong></p>
  
  <p>Validated the above received token using below code manually &amp; <strong>it works fine</strong></p>
  
  <pre><code> IConfigurationManager&lt;OpenIdConnectConfiguration&gt; configurationManager = new ConfigurationManager&lt;OpenIdConnectConfiguration&gt;("https://login.microsoftonline.com/TestDomain310320.onmicrosoft.com/v2.0/.well-known/openid-configuration", new OpenIdConnectConfigurationRetriever());
              OpenIdConnectConfiguration openIdConfig = AsyncHelper.RunSync(async () =&gt; await configurationManager.GetConfigurationAsync(CancellationToken.None));
  
              TokenValidationParameters validationParameters =
                  new TokenValidationParameters
                  {
                      ValidIssuer = "https://sts.windows.net/a3d2bff3-87dd-497c-b894-f63befdd7496/",
                      ValidAudiences = new[] { "https://vault.azure.net" },
                      IssuerSigningKeys = openIdConfig.SigningKeys
                  };
  
              SecurityToken validatedToken;
              JwtSecurityTokenHandler handler = new JwtSecurityTokenHandler();
              var user = handler.ValidateToken(token, validationParameters, out validatedToken);
  </code></pre>
  
  <p>Modified parameter <strong><em>Scope:<a href="https://graph.microsoft.com/.default" rel="nofollow noreferrer">https://graph.microsoft.com/.default</a></em></strong> &amp; received AAD token successfully but token validation using above code fails with error message "IDX10511: Signature validation failed. Keys tried: '[PII is hidden]'." Verified AAD app with above mentioned client id is having "user.read/user.read.basicall permissions". Why token validation fails if tokens are received from AAD with <strong><em>Scope:<a href="https://graph.microsoft.com/.default" rel="nofollow noreferrer">https://graph.microsoft.com/.default</a></em></strong></p>
  
  <p>Observation:</p>
  
  <p>Token received with <strong><em>scope : <a href="https://vault.azure.net/.default" rel="nofollow noreferrer">https://vault.azure.net/.default</a></em></strong></p>
  
  <pre><code>     {
         "typ": "JWT",
        "alg": "RS256",
         "x5t": "YMELHT0gvb0mxoSDoYfomjqfjYU",
         "kid": "YMELHT0gvb0mxoSDoYfomjqfjYU"
        }
  </code></pre>
  
  <p>While token received with <strong><em>Scope:<a href="https://graph.microsoft.com/.default" rel="nofollow noreferrer">https://graph.microsoft.com/.default</a></em></strong> has extra <strong><em>nonce</em></strong> property to avoid replay attack, is it be the reason for token validation failure?</p>
  
  <pre><code>   {
       "type": "JWT",
      "nonce": "wCXLm9rF5Nma2S7OswU44uAVRpVbM_20WrWJkqbWe6Y",
      "alg": "RS256",
     "x5t": "YMELHT0gvb0mxoSDoYfomjqfjYU",
     "kid": "YMELHT0gvb0mxoSDoYfomjqfjYU"
   }
  </code></pre>
  
  <p>please suggest.</p>