Microsoft Graph API scope/permission

Question

I have registered an app that request following scope openid profile offline_access user.read.all calendars.read tasks.readwrite calendars.readwrite.shared mail.readwrite mail.send contacts.readwrite.

When going through Microsoft identity platform authorize endpoint is it possible for a user to get an accesstoken with a different scope?

We got

• Calendars.Read Calendars.ReadWrite.Shared Contacts.ReadWrite Mail.ReadWrite Mail.Send openid profile Tasks.ReadWrite User.Read.All email
• User.Read profile openid email
• profile openid email User.Read.All Calendars.Read Tasks.ReadWrite Calendars.ReadWrite.Shared Mail.ReadWrite Mail.Send Contacts.ReadWrite
• openid profile Calendars.Read Tasks.ReadWrite Mail.ReadWrite Mail.Send Contacts.ReadWrite

The initial scope for our application might be wrong but we are trying to configure microsoft accounts to replicate this scenario but are failing. Anyone with ideas or guidance on this problem?

"After you use the admin consent endpoint to grant admin consent, you're finished. Users don't need to take any further action. After admin consent is granted, users can get an access token through a typical auth flow. The resulting access token has the consented permissions." <-- In our case it was not

reference: https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-permissions-and-consent#admin-restricted-permissions