I am authenticating a user using OAuth 2.0 with the following scopes:

https://outlook.office.com/IMAP.AccessAsUser.All https://outlook.office.com/SMTP.Send offline_access openid profile

To retrieve the user profile picture I need to call this API endpoint with the access token:

https://graph.microsoft.com/v1.0/me/photo/$value

Unfortunately, this API endpoint only works if I include https://graph.microsoft.com/.default in my scopes. More unfortunately, doing so gives me the following error when logging in:

The provided request must include a 'scope' input parameter. The provided value for the input parameter 'scope' is not valid. The scope https://outlook.office.com/IMAP.AccessAsUser.All https://outlook.office.com/SMTP.Send https://graph.microsoft.com/.default offline_access openid profile is not valid. .default scope can't be combined with resource-specific scopes.

I cant seem to retrieve the profile with any scope other than the .default scope, but with that scope I cannot use IMAPS and SMTPS, which I need. What is the correct way to be able to do both?