TIL: Get-MgContext shows the scopes you actually got

You asked Connect-MgGraph for a scope. That does not mean you were granted it — consent, admin policy, and app roles all sit between the ask and the grant.

(Get-MgContext).Scopes returns the scopes on the current token. If the scope you need isn’t in that list, no amount of retrying the call will help. Check the token, not your intentions.