When the scopes laid out in this ask for span multiple resource server, then the Microsoft id System returns a token for your useful resource laid out in the 1st scope. To find out more, see Permissions and consent inside the Microsoft identity System.Entry to ' tenant ' tenant is denied. AADSTS500021 implies which the tenant restriction attribute