I am facing an issue with obtaining an application token using Azure AD’s client credentials flow. Despite having correctly configured and granted the necessary API permissions for my application in Azure AD, the token retrieved using the .default scope does not include all the expected permissions but instead includes 4 permissions (“Mail.ReadWrite, User.Read.All”, Mail.Read”, Mail.ReadBasic”) but I don’t understand why only these are showing and nothing else. What am I missing?

{ "clientId": "CLIENT_ID", "clientSecret": "CLIENT_SECRET", "scopes": "https://graph.microsoft.com/.default", "urlAccessToken": "https://login.microsoftonline.com/TENANT_ID/oauth2/v2.0/token", "grant_type": "client_credentials" }

I’ve Checked and rechecked API permissions in Azure AD portal.

I expected the application token to include all the API permissions that have been granted to my application in Azure AD.