IdentityServer3 Microsoft Graph scopes and flow
<p>My solution has been working fine authenticating against Azure AD via IdentityServer3. Now we're trying to integrate some Microsoft Graph features. Sadly, it's failing miserably.</p>

<p>Running through one of the demo (<a href="https://graph.microsoft.io/en-us/docs/get-started/aspnetmvc" rel="nofollow noreferrer">https://graph.microsoft.io/en-us/docs/get-started/aspnetmvc</a>) projects, the documentation details the registration of a new application at the Microsoft App Registration Portal (<a href="https://apps.dev.microsoft.com" rel="nofollow noreferrer">https://apps.dev.microsoft.com</a>) and explicitly tell the application to allow implicit flow.</p>

<blockquote>
  <p>Make sure the <strong>Allow Implicit Flow</strong> check box is selected, and enter
  <a href="http://localhost:55065/" rel="nofollow noreferrer">http://localhost:55065/</a> as the Redirect URI.   The <strong>Allow Implicit Flow</strong>
  option enables the OpenID Connect hybrid flow. During authentication,
  this enables the app to receive both sign-in info (the id_token) and
  artifacts (in this case, an authorization code) that the app uses to
  obtain an access token.</p>
</blockquote>

<p>Of course, we already have an application registered on our production portal of Azure that does our Authentication, and from our Client in IdentityServer3, we have the flows set as <code>Flow = Flows.Implicit</code> which would seem to indicate that we're now only allowing implicit flow, but expecting implicit flow.</p>

<p>When I add in the additional scopes - <code>offline_access User.Read Mail.Send</code> - I'm no longer able to successfully authenticate, instead, I'm receiving an error stating <code>Invalid Scope</code>.</p>

<p>My concern is that the "Microsoft App Registration Portal" is just different enough from real life, that something is not being set properly. There's no specific "Allow Implicit Flow" setting on production Azure App Registration, so is it really accepting <code>Implicit Flow</code>?</p>

<p>Has anyone had any luck integrating these two systems and receiving the desired results of full utilization of Microsoft Graph from a single authentication against Azure AD utilizing IdentityServer3?</p>