title: Access token not containing SCP (roles) claims via Microsoft Graph
body: <p>I'm using the Microsoft Graph SDK to get an access token for my application (not a user) in order to read from sharepoint.  I've been following this <a href="https://docs.microsoft.com/en-us/graph/auth-v2-service" rel="nofollow noreferrer">document</a>, as well as posted this <a href="https://stackoverflow.com/questions/55749816/microsoft-graph-and-access-without-a-user">SO question</a>.  The code in the linked SO is the same.  I was able to add application permissions as well as grant them (by pressing the button) in azure portal.  The problem is, the token that comes back to be used does not contain any roles / scp claims in it.  Therefore when using the token, I get the <strong>"Either scp or roles claim need to be present in the token"</strong> message. </p>
  
  <p>Just to be certain, the only value for my scope that I pass when getting the access token is: <code>https://graph.microsoft.com/.default</code>.  I don't pass anything else like Sites.ReadWrite.All (I get an exception if I add that scope anyway).  I'm not sure how to continue troubleshooting and any help would be appreciated.</p>
  
  <p>Edit: added code using the graph SDK shown below:</p>
  
  <pre><code>var client = new ConfidentialClientApplication(id, uri, cred, null, new SessionTokenCache());
  var authResult = await client.AcquireTokenForClientAsync(new[] {"https://graph.microsoft.com/.default"});
  var token = authResult.AccessToken;
  var graphServiceClient = new GraphServiceClient(new DelegateAuthenticationProvider(async request =&gt; {request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", token)}));
  var drives = await graphServiceClient.Sites[&lt;sharepoint_host&gt;].SiteWithPath(&lt;known_path&gt;).Drives.Request().GetAsync(); 
  </code></pre>