Device code flow: Microsoft.Identity.Client.MsalServiceException: AADSTS70011: The provided value for the input parameter 'scope' is not valid - azure

Question

This question is not a duplicate of AADSTS70011: The provided value for the input parameter 'scope' is not valid because that post didn't solve my problem.
This is the code:
using Microsoft.Identity.Client;
var tenantId = "common";
var clientId = "475c75f3-9fdc-4d23-8956-104342a43740";
var apiUrl = "https://graph.microsoft.com";
var app = PublicClientApplicationBuilder.CreateWithApplicationOptions(
new PublicClientApplicationOptions{
TenantId="common",
ClientId=clientId
}
)
.WithRedirectUri("http://localhost")
.Build();
string[] scopes = new string[] {$"{apiUrl}/.default"};
var result = await app.AcquireTokenWithDeviceCode(
scopes,
deviceCodeResult =>
{
Console.WriteLine(deviceCodeResult.Message);
return Task.FromResult(0);
}
).ExecuteAsync();
Console.WriteLine(result.AccessToken);
This is the error message that I get:
Unhandled exception. MSAL.NetCore.4.44.0.0.MsalServiceException:
ErrorCode: invalid_scope
Microsoft.Identity.Client.MsalServiceException: AADSTS70011: The provided value for the input parameter 'scope' is not valid. One or more scopes in 'https://graph.microsoft.com/.default offline_access profile openid' are not compatible with each other.
Trace ID: 977837bb-49bb-448a-990f-f640ee518500
Correlation ID: f6483ab1-e0be-43b0-8859-086b28ac6ea2
Timestamp: 2022-06-12 00:26:35Z
at Microsoft.Identity.Client.OAuth2.OAuth2Client.ThrowServerException(HttpResponse response, RequestContext requestContext)
at Microsoft.Identity.Client.OAuth2.OAuth2Client.CreateResponse[T](HttpResponse response, RequestContext requestContext)
at Microsoft.Identity.Client.OAuth2.OAuth2Client.ExecuteRequestAsync[T](Uri endPoint, HttpMethod method, RequestContext requestContext, Boolean expectErrorsOn200OK, Boolean addCommonHeaders, Func`2 onBeforePostRequestData)
at Microsoft.Identity.Client.OAuth2.OAuth2Client.GetTokenAsync(Uri endPoint, RequestContext requestContext, Boolean addCommonHeaders, Func`2 onBeforePostRequestHandler)
at Microsoft.Identity.Client.OAuth2.TokenClient.SendHttpAndClearTelemetryAsync(String tokenEndpoint, ICoreLogger logger)
at Microsoft.Identity.Client.OAuth2.TokenClient.SendHttpAndClearTelemetryAsync(String tokenEndpoint, ICoreLogger logger)
at Microsoft.Identity.Client.OAuth2.TokenClient.SendTokenRequestAsync(IDictionary`2 additionalBodyParameters, String scopeOverride, String tokenEndpointOverride, CancellationToken cancellationToken)
at Microsoft.Identity.Client.Internal.Requests.DeviceCodeRequest.WaitForTokenResponseAsync(DeviceCodeResult deviceCodeResult, CancellationToken cancellationToken)
at Microsoft.Identity.Client.Internal.Requests.DeviceCodeRequest.WaitForTokenResponseAsync(DeviceCodeResult deviceCodeResult, CancellationToken cancellationToken)
at Microsoft.Identity.Client.Internal.Requests.DeviceCodeRequest.ExecuteAsync(CancellationToken cancellationToken)
at Microsoft.Identity.Client.Internal.Requests.RequestBase.RunAsync(CancellationToken cancellationToken)
at Microsoft.Identity.Client.ApiConfig.Executors.PublicClientExecutor.ExecuteAsync(AcquireTokenCommonParameters commonParameters, AcquireTokenWithDeviceCodeParameters deviceCodeParameters, CancellationToken cancellationToken)
at Program.<Main>$(String[] args) in /home/adrian/azure/Program.cs:line 16
at Program.<Main>(String[] args)
StatusCode: 400
According to this documentation, the device code flow can be reproduced with this script:
TENANT_ID='common'
CLIENT_ID='475c75f3-9fdc-4d23-8956-104342a43740'
output=$(
curl -s https://login.microsoftonline.com/${TENANT_ID}/oauth2/v2.0/devicecode \
-X POST \
-H 'Content-Type: application/x-www-form-urlencoded' \
-d "client_id=${CLIENT_ID}&scope=user.read%20openid%20profile"
)
echo "URL: $(jq -r '.verification_uri' <<<$output)"
echo "CODE: $(jq -r '.user_code' <<<$output)"
read
output=$(
curl -s https://login.microsoftonline.com/${TENANT_ID}/oauth2/v2.0/token \
-X POST \
-H 'Content-Type: application/x-www-form-urlencoded' \
-d "grant_type=urn:ietf:params:oauth:grant-type:device_code&client_id=${CLIENT_ID}&device_code=$(jq -r '.device_code' <<<$output)"
)
curl -s https://graph.microsoft.com/v1.0/me \
-H "Authorization: Bearer $(jq -r '.access_token' <<<$output)" | jq
However, for some reason when I execute the script I don't get any errors. Why?
EDIT: I thought I was using the .default scope in the script too, my bad. This is the updated code, which now returns yet another different error:
TENANT_ID='common'
CLIENT_ID='475c75f3-9fdc-4d23-8956-104342a43740'
output=$(
curl -s https://login.microsoftonline.com/${TENANT_ID}/oauth2/v2.0/devicecode \
-X POST \
-H 'Content-Type: application/x-www-form-urlencoded' \
-d "client_id=${CLIENT_ID}&scope=https%3A%2F%2Fgraph.microsoft.com%2F.default"
)
echo "URL: $(jq -r '.verification_uri' <<<$output)"
echo "CODE: $(jq -r '.user_code' <<<$output)"
read
curl -s https://login.microsoftonline.com/${TENANT_ID}/oauth2/v2.0/token \
-X POST \
-H 'Content-Type: application/x-www-form-urlencoded' \
-d "grant_type=urn:ietf:params:oauth:grant-type:device_code&client_id=${CLIENT_ID}&device_code=$(jq -r '.device_code' <<<$output)"
and this is the error I get:
{
"error": "invalid_scope",
"error_description": "AADSTS70011: The provided value for the input parameter 'scope' is not valid. One or more scopes in 'https://graph.microsoft.com/.default' are not compatible with each other.\r\nTrace ID: 9d5809b7-32ad-4c18-a8d8-4ac49a439100\r\nCorrelation ID: eb10447d-fce6-4a33-b669-c62924f4e08a\r\nTimestamp: 2022-06-12 09:59:54Z",
"error_codes": [
70011
],
"timestamp": "2022-06-12 09:59:54Z",
"trace_id": "9d5809b7-32ad-4c18-a8d8-4ac49a439100",
"correlation_id": "eb10447d-fce6-4a33-b669-c62924f4e08a"
}