How to allow graph and db permissions in app registration active directory loginparameters

Question

Steps to reproduce:

• create an app service (doesn't matter what language/config)
• go to authentication and add built in Microsoft authentication with default settings
• follow this step and add https://graph.microsoft.com/User.Read to the loginParameters (in https://resources.azure.com/ switch to read/write mode and go to subscriptions>XXX>resourceGroups>XXX>providers>Microsoft.Web>sites>XXX>config>authsettingsV2)
• Go to your web site, works fine
• Do the same thing, but instead of Graph give access to SQL, https://sql.azuresynapse-dogfood.net/user_impersonation and load the site, works fine
• Now try to add both:

"loginParameters": [
  "response_type=code id_token",
  "scope=openid offline_access profile https://graph.microsoft.com/User.Read https://sql.azuresynapse-dogfood.net/user_impersonation"
]

Now trying to load the site, it just fails after you authenticate, no message no nothing.

Answer 1

You are attempting to get a token for two different resources. That simply won't work. Any given token is only good for one resource.

When needing to work with more than one resource, you better use MSAL which defer the resource (scope) parameter to their acquire token methods, so that you can acquire different token in your different code path accordingly.