OAuth scopes, one per line or comma-separated. For client credentials, Entra
commonly expects a <code>/.default</code> scope (for example,
<code>https://graph.microsoft.com/.default</code>).