Should the scopes laid out in this ask for span multiple source server, then the Microsoft id platform returns a token with the source laid out in the main scope. For more information, see Permissions and consent while in the Microsoft identity System.InvalidExternalSecurityChallengeConfiguration - Promises sent by external company is not plenty of