MIP SDK fails to protect files

I'm using MIP file sample command line interface to apply labelling. When trying to apply a label that has protection set, i got "Label requires ad-hoc protection, but protection has not yet been set" error. Therefore, I tried protecting the file using "--protect" option and got the following error message: "Something bad happened: The service didn't accept the auth token. Challenge:['Bearer resource="https://aadrm.com", realm="", authorization="https://login.windows.net/common/oauth2/authorize"'], CorrelationId=ce732e4a-249a-47ec-a7c2-04f4d68357da, CorrelationId.Description=ProtectionEngine, CorrelationId=6ff992dc-91b3-4610-a24d-d57e13902114, CorrelationId.Description=FileHandler"

This is my auth.py file:

def main(argv):
  client_id = str(argv[0])
  tenant_id = str(argv[1])
  secret = str(argv[2])

  authority = "https://login.microsoftonline.com/{}".format(tenant_id)
  app = msal.ConfidentialClientApplication(client_id, authority=authority, client_credential=secret)

  result = None

  scope = ["https://psor.o365syncservice.com/.default"]
  result = app.acquire_token_silent(scope, account=None)

  if not result:
    logging.info("No suitable token exists in cache. Let's get a new one from AAD.")
    result = app.acquire_token_for_client(scopes=scope)

  if "access_token" in result:
    sys.stdout.write(result['access_token'])
  else:
    print(result.get("error"))
    print(result.get("error_description"))
    print(result.get("correlation_id"))  # You may need this when reporting a bug


if __name__ == '__main__':
  main(sys.argv[1:])

I tried to change the scope to ["https://aadrm.com/.default"] and then I was able to protect the file, but when I try getting the file status or try applying label on it I get the same error message with bad auth token.

These are the permissions as configured in azure portal:

Thank you

I think that scope you have is incorrect: https://psor.o365syncservice.com/.default

It should be https://syncservice.o365syncservice.com/.default.

A good way to handle this is to just append .default to whatever resource the AcquireToken() call gets in the resource param. Something like this.