Authenticating OData feed from 3rd-party app with Azure AD

[ninabseeq]

I'm a developer of a 3rd-party app that allows users to export OData feeds, which can then be imported into PowerBI. Some of our users use SSO providers (such as Azure Active Directory, and other OAuth providers), and they would like to be able to use these credentials to authenticate OData feeds in PowerBI. I'm trying to enable this.

So far, I created an Azure app and used the "Organizational account" option in the OData feed window to allow a user to sign in with their Microsoft credentials - I did this by having my app reply to PowerBI's initial auth message with an authorization URI (login.microsoftonline.com). Then I can sign in with my credentials. When I click "Connect", PowerBI then sends my app an access token. If I use this token from my app to request a user profile from the UserInfo endpoint on Azure, I get the following error: 
"AADSTS9001014: This token was not issued for the UserInfo endpoint. This may have been a token for Graph or another resource." 

I'm not sure where this is going wrong (the way I configured the Azure app, the URIs I'm using, etc.) or if what I'm trying to do is even possible, but any pointers would be appreciated!

[JirkaZ]

did you request correct scopes when authenticating?

[ninabseeq]

It's not immediately apparent what scopes PowerBI is requesting in its request to Azure AD, but I know it's at least requesting the user_impersonation scope. Adding scopes (openid, profile, email) to the authorization_uri that my app sends to PowerBI doesn't seem to fix the issue.