For ID tokens, this parameter need to be current to include the ID token scopes: openid and optionally profile and e mail. what we??re using the domains for would make an enormous difference as to which just one we use. Entry to ' tenant ' tenant is denied. AADSTS500021 suggests the tenan