I tried it with Azure AD SSO redirect and it works fine. Haven’t tried your scenario. I will give it a try. For the future the ultimate solution is the newly suggested spec where the scope in the manifest will include other domains. Let me know of you manage to resolve your issue in the meantime.