thanks for detailed!

btw, anyone who gets an error -> Either scp or roles claim need to be present in the token

here is the solution;

https://stackoverflow.com/questions/35839675/graph-api-either-scp-or-roles-claim-need-to-be-present-in-the-token