diff --git a/packages/core-app-api/src/apis/implementations/auth/onelogin/OneLoginAuth.ts b/packages/core-app-api/src/apis/implementations/auth/onelogin/OneLoginAuth.ts
index d8f54e7e50..582b5a8282 100644
--- a/packages/core-app-api/src/apis/implementations/auth/onelogin/OneLoginAuth.ts
+++ b/packages/core-app-api/src/apis/implementations/auth/onelogin/OneLoginAuth.ts
@@ -76,7 +76,7 @@ export default class OneLoginAuth {
       oauthRequestApi,
       provider,
       environment,
-      defaultScopes: ['openid', 'email', 'profile', 'offline_access'],
+      defaultScopes: ['openid', 'email', 'profile'],
       scopeTransform(scopes) {
         return scopes.map(scope => {
           if (OIDC_SCOPES.has(scope)) {
diff --git a/plugins/auth-backend-module-onelogin-provider/src/authenticator.ts b/plugins/auth-backend-module-onelogin-provider/src/authenticator.ts
index ab1d4c3238..f6ac3f55d5 100644
--- a/plugins/auth-backend-module-onelogin-provider/src/authenticator.ts
+++ b/plugins/auth-backend-module-onelogin-provider/src/authenticator.ts
@@ -58,6 +58,7 @@ export const oneLoginAuthenticator = createOAuthAuthenticator({
   },
 
   async start(input, helper) {
+    input.scope = 'openid email profile';
     return helper.start(input, {
       accessType: 'offline',
       prompt: 'consent',