RFC 6750 (OAuth 2.0 Bearer Token Usage) section 3 allows a scope attribute in the WWW-Authenticate response header field. Power Query should honor this scope, if present, when obtaining access token...
For example, if the Web data source returns this in the 401 response
WWW-Authenticate: Bearer authorization_uri=entra_authorization_endpoint, scope=some_scope
Power Query would use scope=some_scope in the OIDC redirect to authorization_uri
