I create an application in Azure Active directory via Azure portal. And I have 'Request API permission' for 'user_impersonation'.
In my JS code which uses msal.js library, I tried requested token using this scope, but I don't get any token back.
scopes: ["user_impersonation"]
But if I use
scopes: ["User.Read"]
or
scopes: [.default]
I get a token back.
I tried to reproduce your issue getting the same situation like you as user_imporsonation scope name could be anything you because it is a custom scope, as long as your code check for that same scope name that you created.
Conclude from this github discussion, there might be still sync issue from MS end. You can raise a GITHUB request for the same or you can reach out to AzureSuport Team also.
scope is Application ID URI from Expose an API followed by /.default. Without /.default you will get an error like:
Tried with OAuth2 permissions scopes with changing the Application manifest but didn’t help.
To get this working, you would either have to use ./default, or if trying to specify specific permission, it has to be application permission for it to work with Client_Credentials flow.
For me I am not able to give application permission for my custom scope which I have created in Exposed API and with delegated permission getting the same error. Try if you can give application permission.
