diff --git a/packages/core/src/api/apis/implementations/lib/AuthConnector/DefaultAuthConnector.test.ts b/packages/core/src/api/apis/implementations/lib/AuthConnector/DefaultAuthConnector.test.ts
index 812ee07add..f3698b4e15 100644
--- a/packages/core/src/api/apis/implementations/lib/AuthConnector/DefaultAuthConnector.test.ts
+++ b/packages/core/src/api/apis/implementations/lib/AuthConnector/DefaultAuthConnector.test.ts
@@ -122,4 +122,25 @@ describe('DefaultAuthConnector', () => {
       expiresAt: expect.any(Date),
     });
   });
+
+  it('should use join func to join scopes', async () => {
+    const mockOauth = new MockOAuthApi();
+    const popupSpy = jest
+      .spyOn(loginPopup, 'showLoginPopup')
+      .mockResolvedValue({ scopes: '' });
+    const helper = new DefaultAuthConnector({
+      ...defaultOptions,
+      joinScopes: scopes => `-${[...scopes].join('')}-`,
+      oauthRequestApi: mockOauth,
+    });
+
+    helper.createSession(new Set(['a', 'b']));
+
+    await mockOauth.triggerAll();
+
+    expect(popupSpy).toBeCalledTimes(1);
+    expect(popupSpy.mock.calls[0][0]).toMatchObject({
+      url: 'my-origin/api/auth/my-provider/start?scope=-ab-&env=production',
+    });
+  });
 });
diff --git a/packages/core/src/api/apis/implementations/lib/AuthConnector/DefaultAuthConnector.ts b/packages/core/src/api/apis/implementations/lib/AuthConnector/DefaultAuthConnector.ts
index e9d3918742..498565e10e 100644
--- a/packages/core/src/api/apis/implementations/lib/AuthConnector/DefaultAuthConnector.ts
+++ b/packages/core/src/api/apis/implementations/lib/AuthConnector/DefaultAuthConnector.ts
@@ -43,12 +43,20 @@ type Options<AuthSession> = {
    * API used to instanciate an auth requester.
    */
   oauthRequestApi: OAuthRequestApi;
+  /**
+   * Function used to join together a set of scopes, defaults to joining with whitespace.
+   */
+  joinScopes?: (scopes: Set<string>) => string;
   /**
    * Function used to transform an auth response into the session type.
    */
   sessionTransform?(response: any): AuthSession | Promise<AuthSession>;
 };
 
+function defaultJoinScopes(scopes: Set<string>) {
+  return [...scopes].join(' ');
+}
+
 /**
  * DefaultAuthConnector is the default auth connector in Backstage. It talks to the
  * backend auth plugin through the standardized API, and requests user permission
@@ -69,13 +77,14 @@ export class DefaultAuthConnector<AuthSession>
       basePath = DEFAULT_BASE_PATH,
       environment,
       provider,
+      joinScopes = defaultJoinScopes,
       oauthRequestApi,
       sessionTransform = id => id,
     } = options;
 
     this.authRequester = oauthRequestApi.createAuthRequester({
       provider,
-      onAuthRequest: scopes => this.showPopup([...scopes].join(' ')),
+      onAuthRequest: scopes => this.showPopup(joinScopes(scopes)),
     });
 
     this.apiOrigin = apiOrigin;