When the scopes laid out in this request span multiple useful resource server, then the Microsoft identity System returns a token for that useful resource laid out in the initial scope. To find out more, see Permissions and consent in the Microsoft id platform.Usage of ' tenant ' tenant is denied. AADSTS500021 suggests the tenant restriction aspect