I am working on a project were I am trying to generate token using Authorization Code flow in Azure Entra ID. I have created custom scopes and trying to include those scopes in token. While intiating the authorization I am including required scopes using the scopes query parameter. Every time I add new scopes consent screen is prompted. I am giving user consent to the requested scopes. I have observed that Azure Entra ID includes the already consented scopes by the user inside the token even If I haven’t requested for them while initiating Authorization.

For e.g.,

1. Token Generatation for First Time
   I have included 3 scopes namely Patient, Practitioner and Observation.
   After successful authentication and authorization a token is generated with 3 scopes inside the scp claim.

2. Token Generation for Second Time
   I have included 3 scopes namely Patient, Observation and Condition
   After successful authenticaitno and authorization a token is generated with 4 scopes inside the scp claim.

Despite of requesting 3 scopes I have received 4 scopes. The extra scope is Practitioner scope which I consented while generating Token for First Time.

I google about this behaviour of Azure Entra ID for managing scopes but couldn’t see any relevant information for the same.

Can anyone clarify on the above behaviour as well as my observation about adding the consented scopes inside the token even if not requested. If my observation is right can you point out to links or documents which can justify the same. Any assistance would be of great help to me.