我们已在Azure中为SPA配置了应用注册，用于身份验证代码流。
我们在可选报销申请下添加了电子邮件，如下所示：

清单文件配置如下：

{
    "id": "<redacted>",
    "acceptMappedClaims": true,
    "accessTokenAcceptedVersion": 1,
    "addIns": [],
    "allowPublicClient": null,
    "appId": "<redacted>",
    "appRoles": [],
    "oauth2AllowUrlPathMatching": false,
    "createdDateTime": "2020-12-03T10:30:07Z",
    "disabledByMicrosoftStatus": null,
    "groupMembershipClaims": "None",
    "identifierUris": [],
    "informationalUrls": {
        "termsOfService": null,
        "support": null,
        "privacy": null,
        "marketing": null
    },
    "keyCredentials": [],
    "knownClientApplications": [],
    "logoUrl": null,
    "logoutUrl": null,
    "name": "<redacted>",
    "oauth2AllowIdTokenImplicitFlow": false,
    "oauth2AllowImplicitFlow": false,
    "oauth2Permissions": [],
    "oauth2RequirePostResponse": false,
    "optionalClaims": {
        "idToken": [],
        "accessToken": [
            {
                "name": "email",
                "source": null,
                "essential": false,
                "additionalProperties": []
            }
        ],
        "saml2Token": []
    },
    "orgRestrictions": [],
    "parentalControlSettings": {
        "countriesBlockedForMinors": [],
        "legalAgeGroupRule": "Allow"
    },
    "passwordCredentials": [],
    "preAuthorizedApplications": [],
    "publisherDomain": "<redacted>",
    "replyUrlsWithType": [
        {
            "url": "https://localhost:44338",
            "type": "Spa"
        }
    ],
    "requiredResourceAccess": [
        {
            "resourceAppId": "<redacted>",
            "resourceAccess": [
                {
                    "id": "<redacted>",
                    "type": "Scope"
                },
                {
                    "id": "<redacted>",
                    "type": "Scope"
                },
                {
                    "id": "<redacted>",
                    "type": "Scope"
                }
            ]
        },
        {
            "resourceAppId": "<redacted>",
            "resourceAccess": [
                {
                    "id": "<redacted>",
                    "type": "Scope"
                }
            ]
        }
    ],
    "samlMetadataUrl": null,
    "signInUrl": null,
    "signInAudience": "AzureADMyOrg",
    "tags": [],
    "tokenEncryptionKeyId": null
}

我们已将电子邮件添加到权限中：

最后，在客户端，我使用MSAL浏览器使用提供的以下作用域启动身份验证：

但是，我一辈子也弄不明白为什么email声明没有出现在access_token中